> ## Documentation Index
> Fetch the complete documentation index at: https://docs.binarly.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Malicious Code Detection

> How the Binarly Transparency Platform detects malware, implants, and supply-chain compromises using YARA/FwHunt rule matching and semantic behavioral analysis.

Malicious code detection identifies malware, implants, and supply-chain compromises embedded in a scanned image, distinct from [vulnerability detection](/resource-center/vulnerability-detection). Where vulnerability detection looks for weaknesses that could be exploited, malicious code detection looks for evidence that a component has already been tampered with or replaced.

## What's detected

Malicious code detection produces the `malware/*` and `suspicious/*` finding classes documented in [Finding Classes Reference](/resource-center/finding-classes#malware), covering known malware threats, confirmed malicious behavior, and UEFI bootkit-style hook installations, alongside signals like executable data segments or missing standard library usage that can indicate tampering.

The same engines also produce the `supply-chain/*` finding class: confirmed supply chain compromises such as a backdoored dependency, a tampered upstream release, or a leaked signing key, matched by signature the same way a malware family is.

## Rule-based detection

Detection is signature and pattern-based rather than version-based: rules match byte sequences, strings, or firmware-specific characteristics directly against the binary.

### YARA

[YARA](https://yara.readthedocs.io/) is a pattern-matching language for hunting known malware families, implants, and supply-chain compromises by signature. YARA rules can target any binary: executables, firmware images, libraries, or raw file blobs. A small number of shipped YARA rules also match vulnerabilities rather than malicious code, and those produce vulnerability findings.

### FwHunt

[FwHunt](https://github.com/binarly-io/FwHunt) is Binarly's YAML-based rule format for UEFI firmware threat hunting. Because it understands UEFI module structure natively, a FwHunt rule can scope to a specific module by GUID and match known-bad implant patterns within it. Most of the shipped FwHunt rules target vulnerabilities rather than malicious code, covered in [Vulnerability Detection](/resource-center/vulnerability-detection); implant detection is the smaller share of the set.

### Rule sourcing

Binarly ships a default set of YARA and FwHunt rules. Customers can also write, test, and deploy their own rules of either type through the [Custom Rule Manager](/user-guides/rule-management/overview).

## Semantic and behavioral detection

Beyond signature matching, malicious code detection also uses semantic and behavioral analysis that doesn't depend on a predefined rule:

* **UEFI firmware** modules are analyzed semantically to identify bootkit and implant behavior directly in the code, independent of a specific YARA or FwHunt signature.
* **ELF binaries** are analyzed for suspicious behavioral characteristics, such as anomalous section attributes or the absence of expected standard library usage, that can indicate tampering even without a signature match.

This analysis runs on Binarly's built-in engines and, unlike YARA and FwHunt rules, isn't configurable through the Custom Rule Manager.

## Related

* [Vulnerability Detection](/resource-center/vulnerability-detection) - Version-based, rule-based, and code-similarity detection of exploitable weaknesses
* [Finding Classes Reference](/resource-center/finding-classes#malware) - Full list of malware, suspicious-code, and [supply chain](/resource-center/finding-classes#supply-chain-classes) classes
* [Custom Rule Manager](/user-guides/rule-management/overview) - Write and deploy your own YARA or FwHunt rules