Hello, I would like to open a topic here regarding YARA. The current implementation of the

yara

table in osquery only supports scanning files on disk. However, the underlying YARA library supports scanning of process memory, which is a critical capability for incident response and forensic investigations. Looking at the osquery implementation,

path

is required in the yara query table.

path

is also validated in the osquery code that calls yara. We thought that by modifying osquery to make

path

optional and adding other table columns that would be useful for memory scanning, such as PID, we would be able to close this gap. I am wondering what it would be required from Elastic to get this change accepted by osquery.

👋 Hi Raquel, welcome! Sounds like a great feature — I would suggest opening a blueprint issue on the repo, and outlining use-cases, a basic implementation/test plan, compatibility or breaking changes to the table etc

this has come up a few times, i wrote this blog post on one way to bypass this on linux using procfs. https://developer.squareup.com/blog/leveraging-linux-internals-to-supercharge-osquery-malware-detection/ That being said, the modifications you are suggesting would be a welcome improvement for other OS and make the tool more useful in general.

Thank you @sharvil and @FG, I have create the blueprint issue. Looking forward to see where this goes and excited to being able to contribute to the community.