Skip to content

Back to the catalog

deepfence/YaraHunter
github.comrepo

deepfence/YaraHunter

YaraHunter is Deepfence's open-source scanner that applies YARA rulesets against container images, running Docker containers, and filesystems to detect indicators of compromise such as malware and cryptominers. It supports CI/CD build-time scanning, at-rest image scanning, and runtime container scanning, with JSON output for automation, and is designed to eventually integrate into the Deepfence ThreatMapper platform. The README walks through detecting the XMRig cryptominer inside a container image as a worked example.

TL;DR Open-source YARA-based scanner that finds malware/IOCs in Docker images, running containers, and filesystems.
Open original ↗
Document

What it is

YaraHunter is distributed as a ready-to-run Docker image (quay.io/deepfenceio/deepfence_malware_scanner_ce:2.5.8), not just source you build yourself — the page gives the exact pull command and a specific version tag.

What to do

Pull and run the scanner against an image mounted via the Docker socket:

docker pull quay.io/deepfenceio/deepfence_malware_scanner_ce:2.5.8
docker run -i --rm --name=deepfence-yarahunter \
     -v /var/run/docker.sock:/var/run/docker.sock \
     -v /tmp:/home/deepfence/output \
     quay.io/deepfenceio/deepfence_malware_scanner_ce:2.5.8 \
     --image-name <target-image> \
     --output=json > scan.json

Rules can be cached across runs by mounting a separate rules directory and passing --rules-path:

docker run -i --rm --name=deepfence-yarahunter \
     -v /var/run/docker.sock:/var/run/docker.sock \
     -v /tmp:/home/deepfence/output \
     -v /tmp/rules:/tmp/rules \
     quay.io/deepfenceio/deepfence_malware_scanner_ce:2.5.8 \
     --image-name <target-image> \
     --output=json \
     --rules-path=/tmp/rules > scan.json

Omit --output=json for human-readable table output instead. To extract just the matched rule names from JSON output for scripting/automation:

cat scan.json | jq '.IOC[] | ."Matched Rule Name"'

Caveats

The page itself states this is a work-in-progress tool (point to its Roadmap/issues list) and is explicitly not intended for scanning infrastructure you don't own — Deepfence disclaims liability for inadequacy of the tool for any purpose. Security issues in the project itself should be reported privately to productsecurity@deepfence.io rather than filed as public GitHub issues.

Organisations named here

  • XMRig

Technologies named here

  • YaraHunter
  • Docker container images
  • YARA
  • Running Docker containers
  • ThreatMapper
  • Filesystems
  • metal3d/xmrig image
  • jq
  • Docker

Techniques named here

  • Malware/IOC scanning of container images
  • At-rest container image scanning
  • Runtime container scanning
  • Filesystem scanning for indicators of compromise
  • Rule caching

Threat actors named here

  • XMRig

Related in Blue Team & Detection