YaraHunter

Deepfence YaraHunter scans container images, running Docker containers, and filesystems to find indicators of malware. It uses a YARA ruleset to identify resources that match known malware signatures, and may indicate that the container or filesystem has been compromised.

YaraHunter can be used in the following ways:

• At build-and-test: scan build artifacts in the CI/CD pipeline, reporting on possible indicators of malware
• At rest: scan local container images, for example, before they are deployed, to verify they do not contain malware
• At runtime: scan running docker containers, for example, if you observe unusual network traffic or CPU activity
• Against filesystems: at any time, YaraHunter can scan a local filesystems for indicators of compromise

Key capabilities:

• Scan running and at-rest containers; scan filesystems; scan during CI/CD build operations
• Run anywhere: highly-portable, docker container form factor
• Designed for automation: easy-to-deploy, easy-to-parse JSON output

YaraHunter is a work-in-progress (check the Roadmap and issues list), and will be integrated into the ThreatMapper threat discovery platform. We welcome any contributions to help to improve this tool.

Quick Start

For full instructions, refer to the YaraHunter Documentation.

Example: Finding Indicators of Compromise in a container image

Images may be compromised with the installation of a cryptominer such as XMRig. In the following example, we'll scan a legitimiate cryptominer image that contains the same xmrig software that is often installed through an exploit:

Pull the official yarahunter image:

docker pull quay.io/deepfenceio/deepfence_malware_scanner_ce:2.5.0

or Build it from source clone this repo and run below command

make docker

Generate License Key

Run this command to generate a license key. Work/official email id has to be used.

curl https://license.deepfence.io/threatmapper/generate-license?first_name=<FIRST_NAME>&last_name=<LAST_NAME>&email=<EMAIL>&company=<ORGANIZATION_NAME>&resend_email=true

Scan

Pull the image that needs to be scanned for example metal3d/xmrig and scan it:

docker pull metal3d/xmrig

Set Product and Licence and scan it:

docker run -i --rm --name=deepfence-yarahunter \
     -e DEEPFENCE_PRODUCT=<ThreatMapper or ThreatStryker> \
     -e DEEPFENCE_LICENSE=<ThreatMapper or ThreatStryker license key> \
     -v /var/run/docker.sock:/var/run/docker.sock \
     -v /tmp:/home/deepfence/output \
     quay.io/deepfenceio/deepfence_malware_scanner_ce:2.5.0 \
     --image-name metal3d/xmrig:latest \
     --output=json > xmrig-scan.json

This returns, among other things, clear indication of the presence of XMRig. Note that we store the output (xmrig-scan.json) for quick and easy manipulation:

Rules can also be cached to use next run by mounting a seperate path and passing rules-path argument

docker run -i --rm --name=deepfence-yarahunter \
     -e DEEPFENCE_PRODUCT=<ThreatMapper or ThreatStryker> \
     -e DEEPFENCE_LICENSE=<ThreatMapper or ThreatStryker license key> \
     -v /var/run/docker.sock:/var/run/docker.sock \
     -v /tmp:/home/deepfence/output \
     -v /tmp/rules:/tmp/rules \
     quay.io/deepfenceio/deepfence_malware_scanner_ce:2.5.0 \
     --image-name metal3d/xmrig:latest \
     --output=json \
     --rules-path=/tmp/rules > xmrig-scan.json

# Extract the IOC array values.  From these, extract the values of the 'Matched Rule Name' key
cat /tmp/xmrig-scan.json | jq '.IOC[] | ."Matched Rule Name"'

This returns a list of the IOCs identified in the container we scanned.

To get table formatted output omit --output=json flag

Get in touch

Thank you for using YaraHunter.

• Start with the documentation
• Got a question, need some help? Find the Deepfence team on Slack
• Got a feature request or found a bug? Raise an issue
• productsecurity at deepfence dot io: Found a security issue? Share it in confidence
• Find out more at deepfence.io

Security and Support

For any security-related issues in the YaraHunter project, contact productsecurity at deepfence dot io.

Please file GitHub issues as needed, and join the Deepfence Community Slack channel.

License

The Deepfence YaraHunter project (this repository) is offered under the Apache2 license.

Contributions to Deepfence YaraHunter project are similarly accepted under the Apache2 license, as per GitHub's inbound=outbound policy.

Disclaimer

This tool is not meant to be used for hacking. Please use it only for legitimate purposes like detecting indicator of compromise on the infrastructure you own, not on others' infrastructure. DEEPFENCE shall not be liable for loss of profit, loss of business, other financial loss, or any other loss or damage which may be caused, directly or indirectly, by the inadequacy of YaraHunter for any purpose or use thereof or by any defect or deficiency therein.