Repository files navigation

Deepfence YaraHunter scans container images, running Docker containers, and filesystems to find indicators of malware. It uses aYARA ruleset to identify resources that match known malware signatures, and may indicate that the container or filesystem has been compromised.

YaraHunter can be used in the following ways:

• At build-and-test: scan build artifacts in the CI/CD pipeline, reporting on possible indicators of malware
• At rest: scan local container images, for example, before they are deployed, to verify they do not contain malware
• At runtime: scan running docker containers, for example, if you observe unusual network traffic or CPU activity
• Against filesystems: at any time, YaraHunter can scan a local filesystems for indicators of compromise

Key capabilities:

• Scan running and at-rest containers; scan filesystems; scan during CI/CD build operations
• Run anywhere: highly-portable, docker container form factor
• Designed for automation: easy-to-deploy, easy-to-parse JSON output

YaraHunter is a work-in-progress (check theRoadmap andissues list), and will be integrated into theThreatMapper threat discovery platform. We welcome any contributions to help to improve this tool.

For full instructions, refer to theYaraHunter Documentation.

Images may be compromised with the installation of a cryptominer such as XMRig. In the following example, we'll scan a legitimiate cryptominer image that contains the same xmrig software that is often installed through an exploit:

Pull the officialyarahunter image:

docker pull quay.io/deepfenceio/deepfence_malware_scanner_ce:2.5.2

or Build it from source clone this repo and run below command

make docker

Run this command to generate a license key. Work/official email id has to be used.

curl https://license.deepfence.io/threatmapper/generate-license?first_name=<FIRST_NAME>&last_name=<LAST_NAME>&email=<EMAIL>&company=<ORGANIZATION_NAME>&resend_email=true

Pull the image that needs to be scanned for examplemetal3d/xmrig and scan it:

docker pull metal3d/xmrig

Set Product and Licence and scan it:

docker run -i --rm --name=deepfence-yarahunter \     -e DEEPFENCE_PRODUCT=<ThreatMapper or ThreatStryker> \     -e DEEPFENCE_LICENSE=<ThreatMapper or ThreatStryker license key> \     -v /var/run/docker.sock:/var/run/docker.sock \     -v /tmp:/home/deepfence/output \     quay.io/deepfenceio/deepfence_malware_scanner_ce:2.5.2 \     --image-name metal3d/xmrig:latest \     --output=json > xmrig-scan.json

This returns, among other things, clear indication of the presence of XMRig. Note that we store the output (xmrig-scan.json) for quick and easy manipulation:

Rules can also be cached to use next run by mounting a seperate path and passingrules-path argument

docker run -i --rm --name=deepfence-yarahunter \     -e DEEPFENCE_PRODUCT=<ThreatMapper or ThreatStryker> \     -e DEEPFENCE_LICENSE=<ThreatMapper or ThreatStryker license key> \     -v /var/run/docker.sock:/var/run/docker.sock \     -v /tmp:/home/deepfence/output \     -v /tmp/rules:/tmp/rules \     quay.io/deepfenceio/deepfence_malware_scanner_ce:2.5.2 \     --image-name metal3d/xmrig:latest \     --output=json \     --rules-path=/tmp/rules > xmrig-scan.json

# Extract the IOC array values.  From these, extract the values of the 'Matched Rule Name' keycat /tmp/xmrig-scan.json | jq '.IOC[] | ."Matched Rule Name"'

This returns a list of the IOCs identified in the container we scanned.

To get table formatted output omit--output=json flag

Thank you for using YaraHunter.

• Start with the documentation
• Got a question, need some help? Find the Deepfence team on Slack
• Got a feature request or found a bug? Raise an issue
• productsecurityat deepfencedot io: Found a security issue? Share it in confidence
• Find out more atdeepfence.io

For any security-related issues in the YaraHunter project, contactproductsecurityat deepfencedot io.

Please file GitHub issues as needed, and join the Deepfence CommunitySlack channel.

The Deepfence YaraHunter project (this repository) is offered under theApache2 license.

Contributions to Deepfence YaraHunter project are similarly accepted under the Apache2 license, as perGitHub's inbound=outbound policy.

This tool is not meant to be used for hacking. Please use it only for legitimate purposes like detecting indicator of compromise on the infrastructure you own, not on others' infrastructure. DEEPFENCE shall not be liable for loss of profit, loss of business, other financial loss, or any other loss or damage which may be caused, directly or indirectly, by the inadequacy of YaraHunter for any purpose or use thereof or by any defect or deficiency therein.