The first step to writing YARA rules is to be able to read and understand them. This exercise will help you do that!



There are a number of great public YARA rules on Github, which you can discover through Github tags (https://github.com/topics/yara), and there are a few public favorite rule sets compiled here: https://github.com/InQuest/awesome-yara



Start by choosing a public rule; try to find something with exciting strings and conditions. 



In the discussion thread linked below, post the rule you selected and describe what the rule does as best you can in common language. What is it looking for? What is it matching and not matching? For this exercise, pretend you're explaining how this rule works to a network administrator who is not familiar with YARA syntax.
