Deep Scanning

YARA is a pattern-matching tool created by Victor Alvarez at VirusTotal. It allows researchers to write rules that describe malware families, suspicious patterns, or any byte-level signatures of interest. Each rule consists of a set of strings (text, hex, or regex) and a boolean condition that determines when the rule fires.

YARA is widely used across the security industry for malware classification, incident response, threat hunting, and artifact triage. Its rule language is simple enough for analysts to write by hand yet expressive enough to describe complex binary patterns.

Learn more at the official YARA documentation.

When you run ScanRook with --mode deep, the scanner performs its standard package inventory and vulnerability enrichment pipeline, then adds a second pass: YARA rule scanning against every file extracted from the target artifact.

This second pass catches threats that exist outside of package managers. A container image might have clean packages but contain a manually dropped crypto miner binary, a web shell planted in /var/www, or hardcoded AWS credentials in a configuration file. Package-level CVE matching cannot detect these because they are not part of any tracked package. YARA pattern matching fills this gap.

YARA findings appear in the report alongside CVE findings, tagged with the rule name, matched file path, and matched strings. They use the HeuristicUnverified confidence tier to distinguish them from confirmed vulnerability matches.

ScanRook ships with a curated set of default YARA rules that cover common threat categories. These rules are community-sourced and regularly updated with each release.

• Cryptocurrency mining indicators— detects Stratum protocol strings, known miner binary signatures, and mining pool configuration patterns
• Web shell detection— identifies PHP, JSP, and ASP web shells by matching eval/exec patterns, obfuscation techniques, and known web shell families
• Reverse shell patterns— catches common reverse shell payloads in bash, Python, Perl, and compiled binaries
• Hardcoded credentials and API keys— flags AWS access keys, private keys, database connection strings, and other secrets embedded in files
• Anti-debugging and packing indicators— detects UPX packing, ptrace-based anti-debug checks, and common binary obfuscation markers

YARA rules follow a structured format with three main blocks: meta for descriptive metadata, strings for the patterns to match, and condition for the boolean logic that determines a match.

rule detect_stratum_mining {
    meta:
        description = "Detects Stratum mining protocol usage"
        severity = "high"
        author = "ScanRook"
    strings:
        $stratum = "stratum+tcp://" ascii
        $stratum_ssl = "stratum+ssl://" ascii
        $mining_subscribe = "mining.subscribe" ascii
    condition:
        any of them
}

Pass custom rules to ScanRook with the --yara flag. You can point to a single .yar file or a directory containing multiple rule files. Custom rules run alongside the bundled defaults.