Here are some references and links to help you get started with testing rules across sample corpora of different types. Consider building both malware and goodware test sets, and organizing them in a directory structure that is easy to reference when running rules recursively across the folders.



Handle malware safely!

Handle malware at your own risk!
Be careful not to accidentally execute samples and infect yourself
Consider using a network-isolated Virtual Machine
Check out some guides for how to build malware analysis VMs
https://zeltser.com/build-malware-analysis-toolkit/ 
https://www.sentinelone.com/labs/building-a-custom-malware-analysis-lab-environment/


Public malware corpora



There are dozens of websites and Github repositories with malware samples for use in detection research. They are all slightly different and may have differing levels of labeling, organization or search capabilities. Here are some of my personal favorites:



MalwareBazaar https://bazaar.abuse.ch
Requires registration
Explorable by search and tags
VirusShare https://virusshare.com
Requires registration
Searchable by hash
MalShare https://malshare.com
Requires registration
Searchable by hash or YARA rule name
Objective See https://objective-see.org/malware.html
Mac malware
Vx Underground https://www.vx-underground.org
No registration, but no search
This one is good for large downloads by year or type of malware


For additional sample sets, check out this list https://zeltser.com/malware-sample-sources/





Public goodware/software collections



For building a corpus of goodware, you'll have to get creative with existing resources. You can build file sets from virtual machines of different operating systems, and you can always use YARA to scan the filesystem of whatever system you're using for your YARA testing. These approaches will require some finagling and experimentation.



Microsoft Developer VMs
https://developer.microsoft.com/en-us/windows/downloads/virtual-machines/ 
Download VMware VMDK and use 7zip to extract into folder
https://twitter.com/stvemillertime/status/1512053886634401795
Ubuntu ISOs
https://ubuntu.com/
Build a VM, copy or zip and extract file system files onto your YARA system




Additional reading



Check out this guide for organizing and using the Vx Underground malware set for malware research

https://stairwell.com/news/threat-research-detection-research-labeled-malware-corpus-yara-testing/


