Wiz Adds Agentless YARA-Based Detection for Cloud Malware

Summary

Wiz says its agentless cloud scanning now uses proprietary YARA rules to detect malware variants, including webshells, Sliver, Trojan payloads and crypto miners. The announcement also describes XMRig and reverse-TCP detection examples.

Key points

Wiz says its new proprietary YARA rules scan files agentlessly across cloud environments to identify malware variants.
The rules target malware types including webshells such as Godzilla, Sliver, Trojan payloads and crypto miners.
The XMRig rule checks for a combination of command-line arguments and compilation strings that Wiz says can indicate custom-compiled mining software.
The reverse-TCP rule looks for attributes including a small file size, an ELF header, and assembly patterns that build “//bin/sh” and invoke execve.
Wiz describes the agentless scanning as complementary to its runtime sensor, which analyzes binaries when they execute.
Wiz says its Security Graph correlates malware findings with risks such as public exposure, cleartext secrets, sensitive data, high privileges and lateral movement paths.

Article Details

Event Type: Wiz introduced pattern-based, agentless malware detection using proprietary YARA rules.
Impact: Wiz says the capability continuously scans customer cloud environments to detect unknown malware variants without deploying an agent. The rules target malware patterns including webshells, Trojan payloads, crypto miners, and offensive security tools; the article does not report a specific breach or customer impact.