YARA looks for malware and indicators of compromise by matching a curated set of detection rules against host files and, optionally, the memory of running processes. It complements ClamAV. ClamAV matches known malware signatures, while YARA rules can also describe the patterns and behaviors of malware families, web shells, and attacker tools.
Supports: NIST 800-53 SI-3 (Malicious Code Protection) and SI-4 (System Monitoring).
What you get
Each rule that matches a file or process becomes one finding. A finding includes:
- The file path, or the process ID for a memory match
- The rule’s malware family, MITRE ATT&CK mapping, author, and references
- Exactly which patterns matched and where in the file they were found
Included rules
Each Reef release includes a curated set of rules from reputable community sources, such as abuse.ch YARAhub. It also includes custom rules for detecting malicious or suspicious code in PHP websites and applications.
Before a scan, Reef automatically skips any rule that fails to load, as well as rules that are too broad to be useful across a whole filesystem. Both help keep false positives down. The scan summary shows how many rules were skipped.
Community rules still vary in quality, so an occasional overly broad match can get through. Review YARA findings with that in mind. If your organization maintains its own rules, you can point Reef at them with the rules_dir option.
Severity
Reef sets each finding’s severity based on the rule’s own metadata:
- Critical: ransomware, rootkits, backdoors, web shells, and command-and-control tools
- High: other malware matches (the same level as a ClamAV detection)
- Medium: hunting rules, suspicious indicators, and potentially unwanted software
If a rule specifies its own severity or score, Reef uses that instead.
Default coverage
The same higher-risk directories as ClamAV (/home, /root, /tmp, /var/tmp, /dev/shm, /opt, /srv, and /var/www), plus /etc. Files larger than 64 MB are skipped, as are dependency and build folders such as node_modules, .venv, and .git.
Options
| Key | Default | Effect |
|---|---|---|
target |
None | A single path to scan. |
paths |
The directories above | A list of paths to scan. |
rules_dir |
Bundled rules | A directory of your own YARA rules, as seen from inside the agent. The host’s filesystem is available under /host, so rules stored at /opt/yara on the host are at /host/opt/yara. |
exclude_dirs |
Dependency and build folders | Folder names to skip. This replaces the default list. |
no_excludes |
false |
Scan every folder, including the ones normally skipped. This is useful for forensic investigations. |
max_file_bytes |
67108864 (64 MB) |
Skip files larger than this size. |
scan_procs |
false |
Also scan the memory of running processes. This option is slower. |
pids |
None | Scan only the memory of these process IDs. |
skip_files |
false |
When scanning process memory, skip the file scan entirely. |
rule_timeout |
60 |
The maximum time, in seconds, spent on any one file or process. |
If a scan produces an unusually large number of matches, Reef may trim the results and mark the scan as partial. A partial scan does not close existing findings.