YAMAGoya: Open Source Threat Hunting Tool using YARA and SIGMA
summary
An open source Windows endpoint hunter is built that applies YARA and SIGMA rules directly in user mode, scans virtual memory of running processes and inspects real‑time ETW events, and ships compiled releases on GitHub. Detection purposely skips file scanning and targets memory and OS behavior, supports GUI and CLI, correlates multiple event types, and already uses 17 ETW providers to reduce false positives; demos show memory and ETW bypass detections working as described.
AI-written summary · about
chapters (10)
- 0:00YAMAGoya introduction
- 3:56Tool concept and GitHub
- 8:27SIGMA rules for OS behavior
- 11:38Memory scan demo
- 17:14ETW fundamentals
- 25:41Custom rule creation
- 31:22Limitations and ETW bypass
- 37:24ETW evasion techniques
- 40:14Use cases
- 42:07Q&A
related talks
40mHunt and Gather: Developing Effective Threat Hunting Techniques
20mDetecting Malicious Files with YARA Rules as They Traverse the Network
26mResource Efficient Malware Scans with YARA + osquery
48m"Utilizing YARA to Find Evolving Malware"
23mThe Convergence Of EBPF, Buildroot, And QEMU For Automated Linux Malware Analysis
36mCyber Werewolves: Emulating the Enemy Before the Full Moon Rises
47mWorm Charming: Harvesting Malware Lures for Fun and Profit
40mThe Game of Cyber Threat Hunting: The Return of the Fun