# Kraken | Cross-platform Yara Scanner Written In Go

**URL:** <https://onehack.st/t/kraken-cross-platform-yara-scanner-written-in-go/162063>\
**Category:** Tools & Scripts\
**Tags:** tools, hacking\
**Created:** [November 10, 2020, 4:56pm UTC](https://onehack.st/t/kraken-cross-platform-yara-scanner-written-in-go/162063 "2020-11-10T16:56:01Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![NoBody](https://onehack.st/user_avatar/onehack.st/nobody/32/163880_2.png) [@NoBody](https://onehack.st/u/NoBody)\
**Post date:** [November 10, 2020, 4:56pm UTC](https://onehack.st/t/kraken-cross-platform-yara-scanner-written-in-go/162063/1 "2020-11-10T16:56:01Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/5/b/5bb405e71f36c6925e1ee11b4cf957c96dec654e.png)

Kraken is a simple cross-platform Yara scanner that can be built for Windows, Mac, FreeBSD and Linux. It is primarily intended for incident response, research and ad-hoc detections (_not_ for endpoint protection). Following are the core features:

- Scan running executables and memory of running processes with provided Yara rules (leveraging [go-yara](https://github.com/hillu/go-yara)).
- Scan executables installed for autorun (leveraging [go-autoruns](https://github.com/botherder/go-autoruns)).
- Scan the filesystem with the provided Yara rules.
- Report any detection to a remote server provided with a Django-based web interface.
- Run continuously and periodically check for new autoruns and scan any newly-executed processes. Kraken will store events in a local SQLite3 database and will keep copies of autorun and detected executables.

Some features are still under work or almost completed:

- Installer and launcher to automatically start Kraken at startup.
- Download updated Yara rules from the server.

**Screenshots**

 ![image](https://onehack.st/uploads/default/original/3X/a/a/aa524a9d62bc9802a45e5e37c00d8f12a791cb8a.png)

 ![image](https://onehack.st/uploads/default/original/3X/d/e/de63fc78c6eec09779c7b5f5bac332081a81831d.png)

**ow to use**

Launch Kraken with any of the available options:

```auto
Usage of kraken:
      --backend string Specify a particular hostname to the backend to connect to (overrides the default)
      --daemon Enable daemon mode (this will also enable the report flag)
      --debug Enable debug logs
      --folder string Specify a particular folder to be scanned (overrides the default full filesystem)
      --no-autoruns Disable scanning of autoruns
      --no-filesystem Disable scanning of filesystem
      --no-process Disable scanning of running processes
      --report Enable reporting of events to the backend
      --rules Specify a particular path to a file or folder containing the Yara rules to use

```

**User Guide**

For details on how to install, use and build Kraken you should refer to the [User Guide](https://kraken.gitbook.io/user-guide/). The original source files for the documentation are available [here](https://github.com/botherder/kraken-docs), please open any issue or pull request pertinent to documentation there.

## GitHub:

> **[GitHub - botherder/kraken: Cross-platform Yara scanner written in Go](https://github.com/botherder/kraken)**
>
> Cross-platform Yara scanner written in Go