Resource Efficient Malware Scans with YARA + osquery
summary
Shows how YARA rules run against files discovered by osquery so scans target executed binaries and monitored directories rather than blind mass scanning. Tests show scanning /etc (≈2,300 files) takes ~0.5s, a 600,000 file user tree ~123s, and increasing rules from 1 to 122 raises time roughly linearly. Direct YARA CLI drives CPU to ~193% on a 2 CPU box while osqueryd-based scans sit around ~5% CPU. Implements a pipeline that pulls distinct process events paths, maps them to YARA sig groups, and applies file integrity monitoring to reduce load and scale to large fleets.
AI-written summary · about
chapters (13)
- 0:00Introduction and background
- 1:28YARA as malware detection
- 3:19YARA rule structure
- 6:31YARA in real-world use
- 9:05Installing and running YARA
- 10:55Performance challenges with YARA
- 13:20Efficient scanning with osquery
- 15:36Configuring osquery for YARA
- 18:27Scanning running processes
- 20:40Scaling YARA scans with osqueryD
- 22:49Enterprise deployment strategies
- 23:56Resource usage comparison
- 25:08Conclusion and future ideas
related talks
48m"Utilizing YARA to Find Evolving Malware"
20mDetecting Malicious Files with YARA Rules as They Traverse the Network
47mWorm Charming: Harvesting Malware Lures for Fun and Profit
20mLeveraging Osquery for DFIR at Scale
42mYAMAGoya: Open Source Threat Hunting Tool using YARA and SIGMA
23mThe Convergence Of EBPF, Buildroot, And QEMU For Automated Linux Malware Analysis
47mDetecting and analyzing files-less malware
33mBasic Malware Analysis for Incident Responders