# YaraHunter

YaraHunter is a Detection Engineering product. It runs on-premises. Pricing is free.

YaraHunter scans container images, running Docker containers, and filesystems using YARA rules to detect malware indicators and signs of compromise.

Checked October 2026.

## What is YaraHunter?

YaraHunter is a malware detection tool that scans container images, running Docker containers, and filesystems using YARA rulesets to identify indicators of malware and potential compromises.

The tool operates across multiple deployment scenarios:
- Build-and-test environments: integrates into CI/CD pipelines to scan build artifacts for malware indicators
- At-rest scanning: examines local container images before deployment to verify they are free from malware
- Runtime scanning: monitors running Docker containers when unusual network traffic or CPU activity is detected
- Filesystem scanning: performs on-demand scans of local filesystems for indicators of compromise

Key technical capabilities include scanning both running and static containers, filesystem analysis, and CI/CD integration support. The tool is packaged as a portable Docker container and provides JSON output for automated processing and integration with other security tools.

YaraHunter is designed for integration into the ThreatMapper threat discovery platform and supports automated deployment scenarios through its standardized output format.

Tags: Security Scanning, Scanner, YARA, CI/CD

## Where it fits in your security program (NIST CSF 2.0)

- [Protect](https://cybersectools.com/guides/building-protect-program-small-team): helps you prevent attacks and keep data safe.
- [Detect](https://cybersectools.com/guides/building-detect-program-small-team): helps you spot attacks and unusual activity.

## Quick facts

- Category: [Security Operations](https://cybersectools.com/categories/security-operations) · [Detection Engineering](https://cybersectools.com/categories/detection-engineering)
- Deployment: On-Premises
- Company size fit: Startup, SMB, Mid-Market, Enterprise
- Pricing model: Free
- GitHub stars: 1,324
- Website: github.com

## Where it ranks

No shortlist covers this product's category yet. The closest is [Best MDR Solutions for Business](https://cybersectools.com/shortlists/best-mdr-solutions).

## YaraHunter FAQ

### What is YaraHunter?

YaraHunter is a product in the Detection Engineering category. It covers Security Scanning, Scanner and YARA.

### What is the pricing for YaraHunter?

YaraHunter is free. Download and setup instructions are at https://github.com/deepfence/YaraHunter/.

### What are alternatives to YaraHunter?

Alternatives to YaraHunter listed on CybersecTools:

1. [Google Security Operations](https://cybersectools.com/tools/google-security-operations) - Cloud-native SIEM, SOAR, and threat intel platform for SecOps teams (Commercial)
2. [Crimson7 Defensive Engineering](https://cybersectools.com/tools/crimson7-defensive-engineering) (Commercial)
3. [Sublime Security Sublime Rules](https://cybersectools.com/tools/sublime-security-sublime-rules) - Open-source detection rules for email attacks like BEC, phishing, and malware (Free)
4. [RuleCheck](https://cybersectools.com/tools/rulecheck) - Automated QA tool for Elastic Security detection rules and queries. (Commercial)

Compare all YaraHunter alternatives at [https://cybersectools.com/alternatives/yarahunter](https://cybersectools.com/alternatives/yarahunter)

### What deployment and organization size does YaraHunter fit?

YaraHunter is available as on-premises software. It is listed for startups, small businesses, mid-market companies and enterprises. It is free.

## Compare YaraHunter with similar solutions

- [YaraHunter vs Google Security Operations](https://cybersectools.com/compare/google-security-operations-vs-yarahunter)
- [YaraHunter vs Crimson7 Defensive Engineering](https://cybersectools.com/compare/crimson7-defensive-engineering-vs-yarahunter)
- [YaraHunter vs Sublime Security Sublime Rules](https://cybersectools.com/compare/sublime-security-sublime-rules-vs-yarahunter)

All alternatives to YaraHunter: [/alternatives/yarahunter](https://cybersectools.com/alternatives/yarahunter)

---

Source: https://cybersectools.com/tools/yarahunter

For AI agents: every CybersecTools shortlist is listed at https://cybersectools.com/shortlists.md, and any compare page has a Markdown copy too (add .md to its URL).

More on YaraHunter: funding, momentum, hiring and news, plus the full product and company record, are available through the Mandos MCP Server (paid plans), which connects to AI assistants: https://mandos.io/mcp?utm_source=cybersectools.com&utm_medium=product-md