Replacing 'signature' with 'rule'.
Sometimes it's a simple task, other times not so.
Rules are generally created (afaik) by examining packet captures of attacks/exploits and then creating rules that match that traffic pattern. The skill is creating a rule that is as precise as possible in order to limit false-positives but generic enough to ensure you catch everything. The built-in rules are created in the same way as many folk create their own rules - analysing packet captures, looking at the bits and bytes to create an appropriate pattern. The easy bit is obviously matching the ports and protocol (i.e. the RULE HEADER).
he traffic flow (i.e. from/to server) but then it becomes more complex with the operators (content, offset, depth, within, distance etc) or invoking pcre. The other tricky element is ensuring that a rule not only catches the traffic but doesn't affect performance detrimentally.
Snort is now a complicated beast (in a good way) and there's a lot more to it than simple rules looking for traffic patterns. The real work happens with the pre-processors and the more recent DAQ module.
Here's an old post that talks about how IDS signatures/rules are created.
A good person to chat to would be Joel Esler (@joelesler), a Sourcefire veteran and member of the VRT team. I'm not sure what he can tell you though he's a sample from him. The folks in the VRT team are real packet monkeys, great developers and perform extensive testing on their rules prior to release. Quite often this testing is done with the vendor or company who has either discovered or been affected by the attack.
There's literally loads of docs on the net about how snort rules are written, many of which are written by Sourcefire employees and the manual.