{"repo":"deepfence/YaraHunter","free":true,"listed":false,"github":"https://github.com/deepfence/YaraHunter","clone":"git clone https://github.com/deepfence/YaraHunter.git","description":"🔍🔍 Malware scanner for cloud-native, as part of CI/CD and at Runtime 🔍🔍","language":"Go","stars":1319,"topics":["devsecops","devsecops-best-practices","devsecops-pipeline","ioc","malware","threat-hunting","yara","yara-scanner","ci-cd","hacktoberfest"],"license":"Apache-2.0","category":"deployment-docker-iac","readme_excerpt":"YaraHunter Deepfence YaraHunter scans container images, running Docker containers, and filesystems to find indicators of malware. It uses a YARA ruleset to identify resources that match known malware signatures, and may indicate that the container or filesystem has been compromised. YaraHunter can be used in the following ways: - At build-and-test : scan build artifacts in the CI/CD pipeline, reporting on possible indicators of malware - At rest : scan local container images, for example, before they are deployed, to verify they do not contain malware - At runtime : scan running docker containers, for example, if you observe unusual network traffic or CPU activity - Against filesystems : at any time, YaraHunter can scan a local filesystems for indicators of compromise Key capabilities: - Scan running and at-rest containers; scan filesystems; scan during CI/CD build operations - Run anywhere: highly-portable, docker container form factor - Designed for automation: easy-to-deploy, easy-to-parse JSON output YaraHunter is a work-in-progress (check the Roadmap and issues list), and will be integrated into the ThreatMapper threat discovery platform. We welcome any contributions to help to improve this tool. Quick Start For full instructions, refer to the YaraHunter Documentation. Example: Finding Indicators of Compromise in a container image Images may be compromised with the installation of a cryptominer such as XMRig. In the following example, we'll scan a legitimiate cryptominer","default_branch":null,"files":null,"tree":[],"storefront":"/r/deepfence","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/deepfence/YaraHunter/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}