YaraHunter is an Apache-2.0 licensed, Go-based malware scanner from Deepfence that examines container images, running Docker containers, and filesystems for indicators of compromise using a YARA ruleset, and it is built for DevSecOps and security engineers who need the same malware check to run inside a CI/CD pipeline, before deployment, and against live containers.

What it is

YaraHunter lives in the cloud-native and container ecosystem and is distributed as a portable Docker container rather than as a host-installed agent. It scans container images, running Docker containers, and local filesystems, matching what it finds against the Deepfence YARA ruleset (github.com/deepfence/yara-rules) to identify resources that match known malware signatures. Matches are reported as indicators of compromise (IOCs) and may indicate that a container or filesystem has been compromised. The project is written in Go, published under the Apache-2.0 licence, documented at threatmapper.org/docs/yarahunter/, and hosted under the Deepfence organisation at deepfence.io.

The concrete problem is that container images and running containers can be compromised, for example by a cryptominer such as XMRig installed through an exploit, and a compromised image can be published or deployed without anyone noticing. YaraHunter addresses that by placing the same rule-based scan at four points: at build-and-test in the CI/CD pipeline, at rest against local container images before deployment, at runtime against running Docker containers when unusual network traffic or CPU activity is observed, and at any time against a local filesystem. The supplied facts do not name a specific product that YaraHunter replaces; the gap it fills is the absence of any malware-signature check on those artifacts.

Key capabilities

• Scans container images at rest, running Docker containers, local filesystems, and build artifacts produced during CI/CD operations.
• Matches scanned resources against the Deepfence YARA ruleset (github.com/deepfence/yara-rules) and reports the resulting indicators of compromise.
• Runs from the published image quay.io/deepfenceio/deepfence_malware_scanner_ce:2.5.8, or is built from source with the make docker command.
• Selects the scan target with the --image-name argument, as in --image-name metal3d/xmrig:latest.
• Emits machine-readable findings with --output=json, including an IOC array whose entries carry the Matched Rule Name key; omitting the flag produces table-formatted output.
• Caches YARA rules between runs with --rules-path=/tmp/rules, passed together with a mounted rules volume.
• Fits automation directly: JSON written to a file can be filtered with jq '.IOC[] | ."Matched Rule Name"' to extract matched rule names.

Who uses it and how

• DevSecOps and pipeline engineers scan build artifacts during CI/CD, matching the project's ci-cd, devsecops-pipeline, and devsecops-best-practices topics.
• Platform and security teams scan local container images at rest before deployment to verify they contain no malware.
• Incident responders scan running Docker containers at runtime after observing unusual network traffic or CPU activity, as in the documented XMRig case.
• Threat hunters and forensic teams scan filesystems for indicators of compromise at any time, matching the ioc and threat-hunting topics.
• Automation consumers parse saved JSON output, for example cat /tmp/xmrig-scan.json | jq '.IOC[] | ."Matched Rule Name"'.

Getting started

Pull the published image with docker pull quay.io/deepfenceio/deepfence_malware_scanner_ce:2.5.8 and run it via docker run, or clone the repository and run make docker to build the image from source. Full instructions live in the YaraHunter documentation at threatmapper.org/docs/yarahunter/.

How it compares

The supplied facts provide no list of paid products that YaraHunter replaces, and they name no comparable malware-scanning tools, so in this registry it stands alone. The nearest project named in the facts is ThreatMapper, the Deepfence threat discovery platform into which YaraHunter is planned to be integrated.

When to use it — and when not to

A self-hoster must run Docker and grant the container the host Docker socket through -v /var/run/docker.sock:/var/run/docker.sock, plus a writable volume such as /tmp for output and, if rules caching is wanted, a rules path. The project describes itself as a work in progress with a public roadmap and issue list, so teams that need a finished, fully supported scanner with stability guarantees should look elsewhere, and anyone unable to mount the Docker socket cannot scan running containers this way. It remains a reasonable choice for teams that already run Docker and want YARA-based malware detection wired into a pipeline and into runtime checks.

docker pull quay.io/deepfenceio/deepfence_malware_scanner_ce:2.5.8

make docker

docker pull metal3d/xmrig

docker run -i --rm --name=deepfence-yarahunter \
     -v /var/run/docker.sock:/var/run/docker.sock \
     -v /tmp:/home/deepfence/output \
     quay.io/deepfenceio/deepfence_malware_scanner_ce:2.5.8 \
     --image-name metal3d/xmrig:latest \
     --output=json > xmrig-scan.json

docker run -i --rm --name=deepfence-yarahunter \
     -v /var/run/docker.sock:/var/run/docker.sock \
     -v /tmp:/home/deepfence/output \
     -v /tmp/rules:/tmp/rules \
     quay.io/deepfenceio/deepfence_malware_scanner_ce:2.5.8 \
     --image-name metal3d/xmrig:latest \
     --output=json \
     --rules-path=/tmp/rules > xmrig-scan.json

# Extract the IOC array values.  From these, extract the values of the 'Matched Rule Name' key
cat /tmp/xmrig-scan.json | jq '.IOC[] | ."Matched Rule Name"'