Skip to main content
Malicious code detection identifies malware, implants, and supply-chain compromises embedded in a scanned image, distinct from vulnerability detection. Where vulnerability detection looks for weaknesses that could be exploited, malicious code detection looks for evidence that a component has already been tampered with or replaced.

​
What’s detected

Malicious code detection produces the malware/* and suspicious/* finding classes documented in Finding Classes Reference, covering known malware threats, confirmed malicious behavior, and UEFI bootkit-style hook installations, alongside signals like executable data segments or missing standard library usage that can indicate tampering. The same engines also produce the supply-chain/* finding class: confirmed supply chain compromises such as a backdoored dependency, a tampered upstream release, or a leaked signing key, matched by signature the same way a malware family is.

​
Rule-based detection

Detection is signature and pattern-based rather than version-based: rules match byte sequences, strings, or firmware-specific characteristics directly against the binary.

​
YARA

YARA is a pattern-matching language for hunting known malware families, implants, and supply-chain compromises by signature. YARA rules can target any binary: executables, firmware images, libraries, or raw file blobs. A small number of shipped YARA rules also match vulnerabilities rather than malicious code, and those produce vulnerability findings.

​
FwHunt

FwHunt is Binarly’s YAML-based rule format for UEFI firmware threat hunting. Because it understands UEFI module structure natively, a FwHunt rule can scope to a specific module by GUID and match known-bad implant patterns within it. Most of the shipped FwHunt rules target vulnerabilities rather than malicious code, covered in Vulnerability Detection; implant detection is the smaller share of the set.

​
Rule sourcing

Binarly ships a default set of YARA and FwHunt rules. Customers can also write, test, and deploy their own rules of either type through the Custom Rule Manager.

​
Semantic and behavioral detection

Beyond signature matching, malicious code detection also uses semantic and behavioral analysis that doesn’t depend on a predefined rule:
  • UEFI firmware modules are analyzed semantically to identify bootkit and implant behavior directly in the code, independent of a specific YARA or FwHunt signature.
  • ELF binaries are analyzed for suspicious behavioral characteristics, such as anomalous section attributes or the absence of expected standard library usage, that can indicate tampering even without a signature match.
This analysis runs on Binarly’s built-in engines and, unlike YARA and FwHunt rules, isn’t configurable through the Custom Rule Manager.