HUNTING MALWARE AND MALICIOUS MCPS IN MEMORY ON KUBERNETES WITH FLEETDM, OSQUERY, AND YARA

Summary from the TLDR InfoSec newsletter

Osquery and Fleet recently added the ability to scan memory at scale using YARA rules via a new yara_process Osquery table. This post walks through how to set up a lab environment for detecting the use of Sliver on a DVWA running in Kubernetes using YARA rules distributed via Fleet. The example is then expanded to detect a malicious local MCP which runs a credential stealer in memory.