A lot of malware utilizes a packer to reduce its footprint and to obfuscate strings, which defeats many simple YARA rules.

One popular packer is UPX https://upx.github.io/

This rule finds files that have been packed with unmodified versions of UPX.

rule upx
{
	meta:
		author = "Daniel Roberson"
		description = "https://github.com/upx/upx"

	strings:
		$s1 = "UPX!"
		$s2 = "UPX executable packer"

	condition:
		(uint32(0) == 0x464c457f or uint16(0) == 0x5a4d) and all of them
}

YARA Rules Index