The default output from IOCScanner should be easily machine-readable.
$ docker run -it --rm --name=deepfence-ioc-scanner -v $(pwd):/home/deepfence/output -v /var/run/docker.sock:/var/run/docker.sock deepfenceio/deepfence-ioc-scanner:latest -image-name deepfenceio/deepfence-ioc-scanner:latest
Initializing....
Scanning image deepfenceio/deepfence-ioc-scanner:latest for IOC...
INFO[2022-06-30 13:00:00] trying to connect to endpoint 'unix:///var/run/docker.sock' with timeout '10s'
INFO[2022-06-30 13:00:00] connected successfully using endpoint: unix:///var/run/docker.sock
INFO[2022-06-30 13:00:00] trying to connect to endpoint 'unix:///run/containerd/containerd.sock' with timeout '10s'
WARN[2022-06-30 13:00:10] could not connect to endpoint 'unix:///run/containerd/containerd.sock': context deadline exceeded
INFO[2022-06-30 13:00:10] trying to connect to endpoint 'unix:///run/k3s/containerd/containerd.sock' with timeout '10s'
WARN[2022-06-30 13:00:20] could not connect to endpoint 'unix:///run/k3s/containerd/containerd.sock': context deadline exceeded
INFO[2022-06-30 13:00:20] container runtime detected: docker
Scanning image /tmp/Deepfence/IOCScanning/df_deepfenceiodeepfenceiocscannerlatest/save-output.tar for IOCs...
include filescan.yar
include filescan.yar
include filescan.yar
include filescan.yar
include filescan.yar
include filescan.yar
include filescan.yar
[{description This rule is looking for B64 offsets of LazyNetToJscriptLoader which is a namespace specific to the internal version of the GadgetToJScript tooling.} {md5 7af24305a409a2b8f83ece27bb0f7900} {rev 4} {author FireEye}]
[{description Identifies GoRat malware in memory based on strings.} {md5 3b926b5762e13ceec7ac3a61e85c93bb} {rev 1} {author FireEye}]
[{date_created 2020-12-01} {date_modified 2020-12-01} {md5 d5d3d23c8573d999f1c48d3e211b1066} {rev 1} {author FireEye}]
[{date_created 2020-11-27} {date_modified 2020-11-27} {md5 d0a830403e56ebaa4bfbe87dbfdee44f} {rev 1} {author FireEye}]
[{author FireEye}]
[{author Akamai CSIRT} {description Rule to detect XOR DDos infection}]
{
"Image Layer ID": "76bf69f202ff803d5f037e1d2407965e6ed2e387ce887fcf05d7fbd1b415409a",
"Matched Rule Name": "Hunting_GadgetToJScript_1",
"String to Match": [ $s1 $s2 $s3],
"Content to Match": ",,,GF6eU5ldFRvSnNjcmlwdExvYWRl,henlOZXRUb0pzY3JpcHRMb2Fk,YXp5TmV0VG9Kc2NyaXB0TG9hZGV",
"Severity": "high",
"Severity Score": 10.00,
"Full File Name": "/tmp/Deepfence/IOCScanning/df_deepfenceiodeepfenceiocscannerlatest/ExtractedFiles/76bf69f202ff803d5f037e1d2407965e6ed2e387ce887fcf05d7fbd1b415409a/home/deepfence/usr/filescan.yar",
"Match Rule Meta": [ value: This rule is looking for B64 offsets of LazyNetToJscriptLoader which is a namespace specific to the internal version of the GadgetToJScript tooling. value: 7af24305a409a2b8f83ece27bb0f7900 value: 4 value: FireEye],
},
{
"Image Layer ID": "76bf69f202ff803d5f037e1d2407965e6ed2e387ce887fcf05d7fbd1b415409a",
"Matched Rule Name": "APT_Backdoor_Win_GoRat_Memory",
"String to Match": [ $murica $murica $murica $murica $murica $murica $rat1 $rat1 $rat2 $rat3 $rat4 $rat5 $rat6 $rat7 $rat8 $rat9 $rat9 $rat10 $rat11 $winblows],
"Content to Match": ",,,,,,,,,,,,,,,,,,,,murica,murica,murica,murica,murica,murica,rat/modules/socks.(*HTTPProxyClient).beacon,rat/modules/socks.(*HTTPProxyClient).beacon,rat.(*Core).generateBeacon,rat.gJitter,rat/comms.(*protectedChannel).SendCmdResponse,rat/modules/filemgmt.(*acquire).NewCommandExecution,rat/modules/latlisten.(*latlistensrv).handleCmd,rat/modules/netsweeper.(*netsweeperRunner).runSweep,rat/modules/netsweeper.(*Pinger).listen,rat/modules/socks.(*HTTPProxyClient).beacon,rat/modules/socks.(*HTTPProxyClient).beacon,rat/platforms/win/dyloader.(*memoryLoader).ExecutePluginFunction,rat/platforms/win/modules/namedpipe.(*dummy).Open,rat/platforms/win.(*winblows).GetStage",
"Severity": "high",
"Severity Score": 10.00,
"Full File Name": "/tmp/Deepfence/IOCScanning/df_deepfenceiodeepfenceiocscannerlatest/ExtractedFiles/76bf69f202ff803d5f037e1d2407965e6ed2e387ce887fcf05d7fbd1b415409a/home/deepfence/usr/filescan.yar",
"Match Rule Meta": [ value: Identifies GoRat malware in memory based on strings. value: 3b926b5762e13ceec7ac3a61e85c93bb value: 1 value: FireEye],
},
{
"Image Layer ID": "76bf69f202ff803d5f037e1d2407965e6ed2e387ce887fcf05d7fbd1b415409a",
"Matched Rule Name": "Trojan_Macro_RESUMEPLEASE_1",
"String to Match": [ $str00 $str01 $str02 $str03 $str04 $str05],
"Content to Match": ",,,,,,For Binary As,Range.Text,Environ(,CByte(,.SpawnInstance_,.Create(",
"Severity": "high",
"Severity Score": 10.00,
"Full File Name": "/tmp/Deepfence/IOCScanning/df_deepfenceiodeepfenceiocscannerlatest/ExtractedFiles/76bf69f202ff803d5f037e1d2407965e6ed2e387ce887fcf05d7fbd1b415409a/home/deepfence/usr/filescan.yar",
"Match Rule Meta": [ value: 2020-12-01 value: 2020-12-01 value: d5d3d23c8573d999f1c48d3e211b1066 value: 1 value: FireEye],
},
{
"Image Layer ID": "76bf69f202ff803d5f037e1d2407965e6ed2e387ce887fcf05d7fbd1b415409a",
"Matched Rule Name": "APT_Builder_PY_REDFLARE_1",
"String to Match": [ $1 $2 $3 $4 $5 $6 $7],
"Content to Match": ",,,,,,,LOAD_OFFSET_32 = 0x612,LOAD_OFFSET_64 = 0x611,class RC4:,struct.pack('\u003cQ' if is64b else '\u003cL',stagerConfig['comms']['config'],_x86.dll,_x64.dll",
"Severity": "high",
"Severity Score": 10.00,
"Full File Name": "/tmp/Deepfence/IOCScanning/df_deepfenceiodeepfenceiocscannerlatest/ExtractedFiles/76bf69f202ff803d5f037e1d2407965e6ed2e387ce887fcf05d7fbd1b415409a/home/deepfence/usr/filescan.yar",
"Match Rule Meta": [ value: 2020-11-27 value: 2020-11-27 value: d0a830403e56ebaa4bfbe87dbfdee44f value: 1 value: FireEye],
},
{
"Image Layer ID": "76bf69f202ff803d5f037e1d2407965e6ed2e387ce887fcf05d7fbd1b415409a",
"Matched Rule Name": "APT_Backdoor_PS1_BASICPIPESHELL_1",
"String to Match": [ $s1 $s2 $s3 $s4 $s5 $s6],
"Content to Match": ",,,,,,function Invoke-Client(),function Invoke-Server,Read-Host 'Enter Command:',new-object System.IO.Pipes.NamedPipeClientStream(,new-object System.IO.Pipes.NamedPipeServerStream(, = iex $",
"Severity": "high",
"Severity Score": 10.00,
"Full File Name": "/tmp/Deepfence/IOCScanning/df_deepfenceiodeepfenceiocscannerlatest/ExtractedFiles/76bf69f202ff803d5f037e1d2407965e6ed2e387ce887fcf05d7fbd1b415409a/home/deepfence/usr/filescan.yar",
"Match Rule Meta": [ value: FireEye],
},
{
"Image Layer ID": "76bf69f202ff803d5f037e1d2407965e6ed2e387ce887fcf05d7fbd1b415409a",
"Matched Rule Name": "XOR_DDosv1",
"String to Match": [ $st0 $st1 $st2 $st3 $st4 $st5 $st6],
"Content to Match": ",,,,,,,BB2FA36AAA9541F0,md5=,denyip=,filename=,rmfile=,exec_packet,build_iphdr",
"Severity": "high",
"Severity Score": 10.00,
"Full File Name": "/tmp/Deepfence/IOCScanning/df_deepfenceiodeepfenceiocscannerlatest/ExtractedFiles/76bf69f202ff803d5f037e1d2407965e6ed2e387ce887fcf05d7fbd1b415409a/home/deepfence/usr/filescan.yar",
"Match Rule Meta": [ value: Akamai CSIRT value: Rule to detect XOR DDos infection],
}include filescan.yar
include filescan.yar
{
"Timestamp": "2022-06-30 13:00:31.400542592 +00:00",
"Image Name": "deepfenceio/deepfence-ioc-scanner:latest",
"Image ID": "6ad57ca08f568fc315a41354aeb18d3279e3165c7671134822c26ae088bedff4",
"IOC": [
]
}
Default log level should be ERROR, so no messages are sent to STDERR on a successful scan
Start with the documentation
Got a question, need some help? Find the Deepfence team on Slack
Got a feature request or found a bug? Raise an issue
![github-actions[bot] avatar](https://avatars.githubusercontent.com/in/15368?v=4 "github-actions[bot]")
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent