YAMAGoya: Open Source Threat Hunting Tool using YARA and SIGMA

YAMAGoya: Open Source Threat Hunting Tool using YARA and SIGMA

Speakers: Shusei Tomonaga (Incident Response Group Member, JPCERT/CC); Tomoya Kamei (Incident Response Team Member, JPCERT/CC)

Conference: CODE BLUE

YouTube: https://www.youtube.com/watch?v=j76RLOKgcHw

Overview

In an era dominated by sophisticated fileless malware and Living Off The Land (LOTL) attack techniques, traditional file-based security solutions often fall short. The talk, "YAMAGoya: Open Source Threat Hunting Tool using YARA and SIGMA," presented by Shusei Tomonaga and Tomoya Kamei from JPCERT/CC, addresses this critical gap by introducing an innovative, open-source endpoint threat hunting tool. YAMAGoya is designed to provide security professionals with a flexible and powerful mechanism to detect advanced threats that evade conventional defenses by focusing on real-time memory analysis and operating system (OS) behavior monitoring.

The motivation behind YAMAGoya stems from the limitations of commercial security products, which are often black boxes, making it difficult for analysts to understand their detection capabilities or customize them for specific threats. YAMAGoya offers transparency and adaptability, allowing users to leverage industry-standard detection rules like YARA for memory scanning and SIGMA for behavioral analysis directly on endpoints. This approach empowers organizations to proactively hunt for threats, respond effectively to incidents, and gain deeper visibility into system activities without requiring kernel-level drivers or complex installations.

This article delves into the technical intricacies of YAMAGoya, exploring its architecture, core functionalities, and the underlying mechanisms that enable its real-time threat detection capabilities. We will examine how it utilizes Event Tracing for Windows (ETW) to monitor OS activities and its unique approach to memory scanning. Furthermore, we will discuss its support for custom rule correlation, which allows for the detection of complex, multi-stage attack scenarios, and analyze its strengths and limitations, particularly concerning ETW evasion techniques.

Background

▶ Watch: Introduction and YAMAGoya's core concept (0:00)

The cybersecurity landscape has evolved significantly, moving beyond simple file-based malware to more evasive techniques. Attackers increasingly rely on fileless malware, which executes directly in memory without touching the disk, and Living Off The Land (LOTL) binaries, which abuse legitimate system tools and processes already present on the victim's machine. These methods make it challenging for traditional antivirus software, primarily designed for signature-based file scanning, to effectively detect and mitigate threats.

In response, threat hunting has emerged as a proactive security discipline, encouraging security teams to actively search for malicious activities that might have bypassed automated defenses. However, conducting effective threat hunting often requires specialized tools that offer deep visibility into endpoint activities. Commercial Endpoint Detection and Response (EDR) solutions provide some of this visibility, but their proprietary, black-box nature can limit customization and transparency. Security analysts frequently face difficulties in understanding the exact detection logic, adjusting rules, or integrating with other security tools, leading to a demand for more flexible and open alternatives.

The challenge lies in collecting granular, real-time data from endpoints without introducing significant overhead or requiring extensive system modifications. Traditional Windows event logs, while useful, often lack the real-time granularity and specific data points needed for advanced behavioral analysis. This necessitates a tool that can tap into lower-level OS events and perform dynamic memory analysis, providing the raw telemetry required for sophisticated threat detection. YAMAGoya aims to fill this void by providing an accessible, open-source solution that directly leverages powerful rule engines like YARA and SIGMA against real-time endpoint data, thereby democratizing advanced threat hunting capabilities.

Key Findings

▶ Watch: Deep dive into YAMAGoya's memory scanning logic (8:00)

YAMAGoya introduces several key findings and contributions to the field of endpoint security and threat hunting:

• Real-time Endpoint Threat Hunting: YAMAGoya provides a powerful, real-time capability to monitor endpoint activities and memory for malicious patterns, directly addressing the need for immediate threat detection against evolving attack techniques.
• Leveraging Open Standards (YARA & SIGMA): The tool effectively integrates two widely adopted open standards for detection: YARA for memory analysis and SIGMA for OS behavior. This allows security professionals to use a vast existing repository of community-driven rules and create custom detections tailored to specific threats.
• User-Mode Operation Without Installation: A significant design choice, YAMAGoya operates entirely in user mode, requiring no kernel-level drivers or complex installation procedures. This makes it highly portable, easy to deploy, and less prone to system instability or conflicts with other security software, a common hurdle for many endpoint tools.
• ETW-Powered Behavioral Analysis: By utilizing Event Tracing for Windows (ETW), YAMAGoya gains access to a rich stream of real-time OS events, including file operations, process execution, registry changes, network connections, and PowerShell activity. This provides a deep, granular level of telemetry essential for behavioral threat detection.
• Optimized Memory Scanning: To overcome the performance challenges of scanning vast memory spaces, YAMAGoya employs an optimized approach. It intelligently tags and filters memory regions, focusing only on those that are committed, private, and, crucially, executable, significantly speeding up YARA scans.
• Advanced Custom Rule Correlation: Beyond individual event detection, YAMAGoya supports the creation of custom rules that correlate multiple events from different ETW providers over a defined time window. This enables the detection of complex, multi-stage attack chains that would be missed by isolated event monitoring, drastically reducing false positives and increasing detection accuracy.
• Dual Interface (GUI & CLI): The tool offers both a graphical user interface (GUI) for ease of use and a command-line interface (CLI) for automation and integration into existing security workflows, catering to a broad range of user preferences and operational needs.
• Open Source and Community Driven: Being open source and available on GitHub, YAMAGoya fosters community collaboration, allowing for continuous improvement, rule sharing, and transparent validation of its detection logic.

Technical Deep Dive

▶ Watch: Custom rules for correlating multiple event types (20:00)

YAMAGoya's core strength lies in its dual-pronged approach to threat hunting: real-time memory scanning and comprehensive OS behavior monitoring, both powered by industry-standard detection rules and advanced Windows telemetry.

Memory Scan with YARA

For detecting fileless malware and in-memory threats, YAMAGoya employs YARA rules against processes' virtual memory spaces. Recognizing that scanning an entire 8GB or larger memory space is impractical, YAMAGoya optimizes this process through intelligent filtering:

1. Process Information Extraction: YAMAGoya first extracts information about all running user-mode processes.
2. Memory Space Tagging and Filtering: For each process, it analyzes the virtual memory map. Memory regions are tagged based on their attributes. YAMAGoya specifically targets regions that are:

• Committed: Memory that has been physically allocated.
• Private: Memory not shared with other processes.
• Executable: Crucially, regions marked with execute permissions (PAGE_EXECUTE, PAGE_EXECUTE_READ, PAGE_EXECUTE_READWRITE, PAGE_EXECUTE_WRITECOPY). This significantly narrows the scope, as malicious payloads often reside in executable memory.

1. YARA Rule Application: Once these targeted memory spaces are identified, YAMAGoya applies user-defined YARA rules to scan for specific patterns, strings, or byte sequences indicative of malware. This focused approach ensures efficient scanning while maintaining high detection efficacy for in-memory threats.

The talk demonstrated this by using a YARA rule designed to detect Lazarus malware families, showcasing YAMAGoya's ability to identify malicious code loaded directly into memory.

OS Behavior Monitoring with SIGMA and ETW

The second pillar of YAMAGoya's detection capability is its real-time monitoring of OS activities, powered by Event Tracing for Windows (ETW) and SIGMA rules.

Understanding ETW

ETW (Event Tracing for Windows) is a high-performance, kernel-level event tracing facility built into the Windows OS. It allows applications and the OS itself to generate events, which can then be collected for debugging, performance analysis, or, as in YAMAGoya's case, security monitoring. ETW operates with three main components:

1. Providers: Applications or OS components that generate events. Windows has over 1000 built-in ETW providers.
2. Consumers: Applications that subscribe to and receive events from ETW sessions. YAMAGoya acts as an ETW consumer.
3. Controllers: Manage ETW sessions, starting and stopping them, and configuring which providers' events are collected. YAMAGoya incorporates some controller functionalities to set up its monitoring sessions.

Unlike traditional Windows Event Logs, which store events after they occur, ETW provides a real-time stream of events directly from the OS kernel and user-mode applications. This live feed is crucial for immediate threat detection.

YAMAGoya's ETW Implementation

YAMAGoya configures ETW sessions to collect events from a carefully selected set of 17 ETW providers. These providers cover a wide range of critical OS activities, including:

• File Operations: Microsoft-Windows-Kernel-File, Microsoft-Windows-SMBClient
• Process Activity: Microsoft-Windows-Kernel-Process, Microsoft-Windows-Threat-Intelligence (though with limitations, see ETW Evasion section)
• Registry Modifications: Microsoft-Windows-Kernel-Registry
• Scripting & Automation: Microsoft-Windows-PowerShell, Microsoft-Windows-WinRM, Microsoft-Windows-WMI-Activity
• Network Activity: Microsoft-Windows-DNS-Client, Microsoft-Windows-Kernel-Network, Microsoft-Windows-TCPIP, Microsoft-Windows-WinINet
• Security Events: Microsoft-Windows-Security-Auditing (partial), Microsoft-Windows-Sysmon (if installed, though YAMAGoya aims to be independent)
• Other: Microsoft-Windows-Kernel-IoTrace

By collecting events from these providers, YAMAGoya gains visibility into actions such as file creation/deletion, process execution, network connections, DNS queries, PowerShell script block logging, WMI queries, and registry changes – all common indicators of malicious activity. These events are then fed into the SIGMA rule engine for detection. SIGMA rules, written in a generic YAML format, describe detection logic based on event attributes, allowing for flexible and platform-agnostic threat detection.

Custom Rule Correlation

One of YAMAGoya's most advanced features is its ability to create custom detection rules that correlate multiple events across different ETW providers within a specified time window. This addresses a critical limitation of single-event detection: complex attacks often involve a sequence of seemingly benign actions that, when viewed together, reveal malicious intent.

Custom YAMAGoya rules are structured with:

• Rule Name and Description.
• A Rules section containing individual detection criteria, each with:
• Rule Type: Specifies the data type to match (e.g., regex, binary, IPv4).
• Target: The event category or ETW provider to monitor (e.g., File, Process, Registry, Network).
• Rule: The specific pattern or value to detect (e.g., a file name, process path, IP address).

The talk provided an example of detecting an ANL malware infection flow, which involves:

1. Creation of a decoy file (e.g., tnp.dcx).
2. Execution of a legitimate application (e.g., scan_cfg32.exe) used for DLL side-loading.
3. Loading of a malicious DLL (e.g., VSODscpl.dll).
4. Loading of a malicious data file by the DLL.
5. Outbound communication to a known malicious IP address.

A custom YAMAGoya rule can combine these individual events, triggering an alert only when all conditions are met within a defined timeframe. This significantly reduces false positives and allows analysts to identify complete infection chains rather than isolated actions, providing a more accurate and confident detection of sophisticated threats.

ETW Evasion and Detection Challenges

Despite its strengths, YAMAGoya, like any ETW-dependent tool, faces challenges from ETW evasion techniques. Attackers, often seeking to bypass EDRs that also rely on ETW, have developed methods to prevent ETW events from being generated or collected.

The talk categorizes ETW evasion into:

• ETW Session Attacks: Targeting the ETW session itself.
• ETW Provider Attacks: Targeting the providers that generate events.

These attacks can occur within the accessing process itself, from a remote process, or at the kernel level. A common technique is patching the EtwEventWrite function in user mode. This Windows API is responsible for writing ETW events; by patching it to immediately return, attackers can prevent events from their process from being emitted.

YAMAGoya's ability to detect ETW evasion depends on whether the evasion itself generates an ETW event that YAMAGoya is configured to monitor:

• Detectable Evasions: YAMAGoya can detect evasions that involve configuration changes via PowerShell scripts (e.g., Kill-ETW.ps1), registry modifications, or deletion of ETL files. These actions typically generate events through providers like Microsoft-Windows-PowerShell or Microsoft-Windows-Kernel-Registry, which YAMAGoya monitors.
• Undetectable Evasions: YAMAGoya cannot detect evasions involving user-space patching of ETW providers (like EtwEventWrite) or kernel-level attacks on ETW sessions or providers. This is because YAMAGoya operates in user mode and relies on the integrity of the ETW event stream. If the event is never generated or is blocked at a lower level, YAMAGoya will not see it.

The talk mentions ETWTI (Event Tracing for Windows Threat Intelligence) as a potential ETW provider that could detect such evasions. However, subscribing to ETWTI events typically requires a Protected Process Light (PPL) protected process or Microsoft-signed certificates, which is beyond YAMAGoya's current user-mode capabilities without resorting to less secure methods like using BYOVD (Bring Your Own Vulnerable Driver) or test signing mode. Despite this, YAMAGoya can still detect the actions leading to patching, such as changes in memory protection permissions (e.g., using VirtualProtect) which often precede EtwEventWrite patching.

Demo / Proof of Concept

▶ Watch: Demo: Detecting LSASS memory dump with custom rule (25:00)

The speakers presented several compelling demonstrations to showcase YAMAGoya's capabilities:

1. OS Behavior Detection with SIGMA (CLI & GUI):

• The first demo illustrated YAMAGoya's ability to detect suspicious OS behavior in real-time using SIGMA rules.
• In the CLI, the yamagoya.exe -d <rules_folder> -a command was shown, where -d specifies the folder containing YARA and SIGMA rules, and -a targets all categories. Upon detection, an alert log appeared in red text.
• The GUI demo mirrored this functionality, allowing users to select rule folders, enable SIGMA rules, and start real-time monitoring. Alerts were displayed in a dedicated "Alerts" tab, and logs could also be saved to text files or Windows Event Logs for persistence and further analysis. This demonstrated YAMAGoya's user-friendly interfaces for different operational needs.

1. Memory Scan with YARA:

• This demo highlighted YAMAGoya's effectiveness against fileless malware. The speakers used a YARA rule specifically crafted to detect Lazarus malware.
• The command-line execution involved enabling the YARA scan option (which is disabled by default) and specifying the rule folder.
• Upon execution, YAMAGoya loaded the YARA rules and began scanning active processes. Due to the potentially large memory footprint, the scan took some time. When the Lazarus malware was detected in memory, YAMAGoya displayed an alert in the "Alerts" tab, showing details like Process ID, process name, and path, confirming its ability to find in-memory threats.

1. Custom Rule for LSASS Memory Dump Detection:

• This demo showcased the power of YAMAGoya's custom rule correlation feature. The scenario involved detecting the creation of an LSASS memory dump, a common technique used by attackers for credential harvesting.
• The custom rule was designed to correlate two events: the acquisition of a handle to the LSASS process and the creation of a dump file.
• Using Process Explorer, an LSASS memory dump was initiated. YAMAGoya, running with the custom rule enabled, successfully detected this suspicious sequence of actions, even with a slight delay due to the configured time window for event correlation. The alert confirmed the detection of the LSASS memory dump, illustrating how YAMAGoya can identify complex attack behaviors by correlating multiple event types.

1. ETW Evasion Detection:

• The final demo focused on YAMAGoya's capability to detect certain ETW evasion techniques.
• A PowerShell script, observed in a real-world campaign targeting Europe in February 2025 (likely a typo for 2020/2021 given the context of observed incidents), was used. This script patched the EtwEventWrite function to suppress ETW event generation.
• YAMAGoya's custom rule was designed to detect specific byte patterns or strings within the PowerShell Script Block Text events that are indicative of this patching activity.
• When the evasion script was executed, YAMAGoya successfully detected the malicious PowerShell activity, demonstrating that while some ETW evasions are hard to detect directly, YAMAGoya can often identify the means by which the evasion is performed if those means generate observable ETW events.

Defensive Implications

▶ Watch: Q&A: YAMAGoya vs. Sysmon and practical use cases (38:00)

YAMAGoya offers significant defensive implications for organizations aiming to bolster their endpoint security posture against modern threats:

1. Enhanced Threat Hunting Capabilities: Security teams can leverage YAMAGoya for proactive threat hunting, actively searching for fileless malware, LOTL abuses, and other advanced persistent threats that might bypass traditional EDRs. Its real-time monitoring and YARA/SIGMA integration provide the flexibility to hunt for novel or targeted threats based on intelligence.
2. Incident Response Augmentation: During an incident, YAMAGoya can be deployed rapidly across affected or potentially affected endpoints. Its standalone, no-installation nature makes it ideal for quick deployment to gather real-time forensic data, identify the scope of an compromise, and detect similar malicious activities across the environment.
3. Customized Detection Logic: The ability to use and create custom YARA and SIGMA rules empowers defenders to tailor their detection strategies to specific threats, industry-specific attack patterns, or unique organizational risks. This moves beyond generic signatures to highly specific behavioral indicators relevant to their environment.
4. Visibility into Evasive Techniques: By focusing on ETW, YAMAGoya provides deeper visibility into OS activities than traditional logs. While it has limitations against direct ETW bypasses, understanding what it can detect (e.g., PowerShell commands used for evasion, memory protection changes) helps defenders build a more complete picture of attacker tradecraft.
5. Complementing Existing Security Stacks: YAMAGoya should be seen as a powerful complement, not a replacement, for existing EDR solutions. Its open-source nature provides transparency and customization often lacking in commercial tools, allowing it to fill detection gaps or provide an independent validation layer.
6. Understanding Attacker Behavior: The custom rule correlation feature helps defenders move from detecting isolated events to understanding full attack chains. This contextual awareness is critical for effective defense, allowing for better prioritization of alerts and more targeted remediation efforts.
7. Automation and Integration: The command-line interface facilitates automation, enabling integration with security orchestration, automation, and response (SOAR) platforms or custom scripts for scheduled scans and alert processing.

Key Takeaways

• YAMAGoya is an open-source, user-mode endpoint threat hunting tool that leverages YARA for memory scanning and SIGMA for real-time OS behavior analysis.
• It directly addresses the challenges posed by fileless malware and Living Off The Land (LOTL) attacks, which often evade traditional file-based security products.
• The tool utilizes Event Tracing for Windows (ETW) from 17 specific providers to gain deep, real-time visibility into critical OS activities without requiring kernel drivers or complex installations.
• YAMAGoya supports advanced custom rules that correlate multiple event types from different ETW providers over a defined time window, enabling the detection of complex, multi-stage attack scenarios with high accuracy.
• While YAMAGoya can detect some ETW evasion techniques (e.g., PowerShell-based configuration changes), it cannot detect others that involve user-space patching of ETW functions or kernel-level attacks.
• Its dual GUI and CLI interfaces make it flexible for both manual threat hunting and automated incident response, providing a powerful, transparent, and customizable addition to any security stack.

About the Speaker(s)

Shusei Tomonaga is an Incident Response Group Member at JPCERT/CC. His work focuses on developing tools and techniques for effective threat hunting and incident response, particularly in the face of evolving attack methodologies like fileless malware.

Tomoya Kamei is an Incident Response Team Member at JPCERT/CC. He contributes to the analysis of advanced threats and the development of defensive strategies, including leveraging real-time endpoint telemetry for improved detection.