Use the official YARA “Writing YARA rules” documentation. Research syntax and modifier restrictions before answering. Questions test rule interpretation, not whether a single pattern is sufficient for production detection.