Write a YARA rule that does not false-positive

The steps, in order

1. 1

   Step 1

   Start with strings, not complex conditions. A rare, long needle is worth more than three clever conditions.

2. 2

   Step 2

   Use wide for Windows binaries and nocase only where the vendor actually varies case. nocase on the whole string widens matches a lot.

3. 3

   Step 3

   Add filesize as an escape filter, not an entry filter. The prefilter already decides which files reach the rule.

4. 4

   Step 4

   Test the rule on a corpus that includes legitimate files. A rule that catches the sample and three signed installers is a lost rule.

5. 5

   Step 5

   Set meta.severity correctly: critical or high pushes the score over the threshold. A “medium” rule cannot produce a malicious verdict on its own.

6. 6

   Step 6

   Drafts generated by the AI analyst are never auto-installed. You read them, test them, then put them on disk.