YARA matches a bundled rule set against host files and, optionally, running process memory.
- Tool —
yara-pythonover a baked-in rule set at/opt/agent/yara-rules, raw output as json. - Findings — one per
(location, rule)match: a host file path, orpid <n>for a process-memory hit.
Included Rules
Each release of Reef provides a curated set of best practice rules from various sources. This includes some custom rules for identifying malicious (or suspicious) code in PHP-powered websites and applications.
Rule quality gates
Rule files that don’t compile (missing module, syntax error, dangling include) are skipped and counted, so one bad file never sinks the whole scan, and survivors compile into a single ruleset that is reused across jobs in the agent process.
A loose-rule gate (agent/runners/_yara_quality.py) also skips any rule file whose every rule is too broad for a filesystem sweep — any of them over one-character strings, ubiquitous words like encrypted, a placeholder name,
or a meta note admitting it’s FP-prone — unless the condition carries a real anchor (magic bytes, filesize, pe./elf./math./hash., a #/@ operator, 3+ of …, or a for loop). Skipped counts show up in summary.rules_skipped_loose.
Severity
Inferred from each rule’s own metadata/tags: an explicit severity or numeric score is respected; ransomware/rootkit/backdoor/webshell/C2 tags map to critical; hunting/suspicious/PUA map to medium; otherwise a
malware-rule match is high (the same bracket as ClamAV). Findings carry the rule’s family, ATT&CK mapping, author, references, and the matched string identifiers + offsets.
No container-vs-host trick needed
Unlike Lynis or OpenSCAP, YARA matches bytes at a path, so it can scan the host filesystem straight through the read-only /host mount, and process memory straight through /proc (the agent’s pid: host makes those the host’s processes) — no nsenter required.
Params
| Key | Default | Effect |
|---|---|---|
target |
— | one host-absolute path to scan |
paths |
risk dirs + /etc |
list of host-absolute paths to scan |
rules_dir |
/opt/agent/yara-rules (REEF_YARA_RULES) |
override the rule directory |
exclude_dirs |
package-cache / VCS / build dir names | replaces the prune list (basenames, not paths) |
no_excludes |
false |
walk the heavy trees too (forensics) |
max_file_bytes |
67108864 |
skip files larger than this |
scan_procs |
false |
also scan running process memory (slow) |
pids |
— | scan only these PIDs’ memory (implies scan_procs); skip_files then skips the file sweep |
rule_timeout |
60 |
per-file / per-process YARA timeout, seconds |
The bundled rule set is community-sourced (abuse.ch YARAhub and similar) —
expect the odd overly broad rule to slip past the gate. Curate
agent/yara-rules/ for your own fleet rather than trusting it blindly. The
JSON payload is trimmed if it would exceed REEF_YARA_SOFT_MAX_BYTES, and a
truncated/over-budget run is marked non-authoritative.