YaraHunter scans container images, running Docker containers, and filesystems to find indicators of malware. It uses a YARA ruleset to identify resources that match known malware signatures, and may indicate that the container or filesystem has been compromised. YaraHunter can be used in the following ways: - At build-and-test: scan build artifacts in the CI/CD pipeline, reporting on possible indicators of malware - At rest: scan local container images, for example, before they are deployed, to verify they do not contain malware - At runtime: scan running docker containers, for example, if you observe unusual network traffic or CPU activity - Against filesystems: at any time, YaraHunter can scan local filesystems for indicators of compromise Key capabilities: - Scan running and at-rest containers - Scan filesystems - Scan during CI/CD build operations Run anywhere: highly-portable, docker container form factor Designed for automation: easy-to-deploy, easy-to-parse JSON output YaraHunter is a work-in-progress (check the Roadmap and issues list), and will be integrated into the ThreatMapper threat discovery platform. We welcome any contributions to help improve this tool.
A .NET wrapper for libyara that provides a simplified API for developing tools in C# and PowerShell.
Automate the process of writing YARA rules based on executable code within malware.
A script to detect and remove Canary Tokens with simple signature-based detections.
dynStruct is a tool for monitoring memory accesses of an ELF binary and recovering structures of the original code.
A strings statistics calculator for YARA rules to aid malware research.
An AI-powered career platform that automates the creation of cybersecurity job application materials and provides company-specific insights for job seekers.
A weekly newsletter providing cybersecurity leadership insights, industry updates, and strategic guidance for security professionals advancing to management positions.
An AI-powered platform that automates threat hunting and analysis by processing cyber threat intelligence and generating customized hunt packages for SOC teams.
Aikido is an all-in-one security platform that combines multiple security scanning and management functions for cloud-native applications and infrastructure.
Permiso is an Identity Threat Detection and Response platform that provides comprehensive visibility and protection for identities across multiple cloud environments.
Wiz Cloud Security Platform is a cloud-native security platform that enables security, dev, and devops to work together in a self-service model, detecting and preventing cloud security threats in real-time.
Adversa AI is a cybersecurity company that provides solutions for securing and hardening machine learning, artificial intelligence, and large language models against adversarial attacks, privacy issues, and safety incidents across various industries.