c0m4r/paranoya repository overview
Quick reference
Maintained by: c0m4r
Project website: https://github.com/c0m4r/paranoya
Where to get help: Github Issues
Supported tags and respective Dockerfile links
Dockerfile
FROM alpine:3.21
WORKDIR /paranoya
RUN apk add --no-cache bash gcc git musl-dev linux-headers openssl-dev python3 python3-dev py3-pip wget \
&& adduser -D paranoya \
&& git clone https://github.com/c0m4r/paranoya.git . \
&& ./deploy.sh \
&& rm -rfv .git .github .gitignore addons test \
&& chown -R paranoya:paranoya /paranoya \
&& apk del --no-cache gcc git musl-dev linux-headers openssl-dev python3-dev
EXPOSE 1337
USER paranoya
CMD [ "python3", "paranoya.py", "-d", "--listen-host", "0.0.0.0", "--noindicator", "--noprocscan", "--nolog" ]
What is paranoya?
A fork of Loki - Simple IOC and YARA Scanner, rewritten for Linux and modified to support single file scans, as well as a daemon mode to accept scans in a client/server manner. It also includes some other improvements.
Dependencies
Python modules
colorama | progressbar2 | psutil | requests | yara-python
Base YARA rules
Neo23x0/signature-base | reversinglabs-yara-rules
Custom YARA rules
elastic/protections-artifacts | PhishingKit-Yara-Rules | malpedia/signator-rules | YARAHQ/yara-forge
How to use this image
docker run --name paranoya -v /tmp:/tmp -p 127.0.0.1:1337:1337 -d c0m4r/paranoya
This will start paranoya as a daemon/server, listening on tcp/1337, waiting for scan requests from a client.
To be able to scan anything outside of Docker, you have to mount a volume pointing to a specific directory, f.e. /tmp, as in this example.
See README usage for more information
To scan a specific file or directory you can use paranoya client.py, which utilizes daemon/server mode:
docker exec -it paranoya ./client.py -p /tmp/some-very-bad-file
or paranoya.py directly as a one-shot scan:
docker exec -it paranoya ./paranoya.py -p /tmp/some-very-bad-file
Docker compose
An example docker-compose.yml:
version: '3'
services:
paranoya:
image: c0m4r/paranoya:latest
volumes:
- /tmp:/tmp
ports:
- 127.0.0.1:1337:1337
To prevent paranoya from pulling signatures every single time, you can either use upgrader.py locally or first run docker compose up -d with the above config, then copy signatures into your host:
sudo docker compose cp paranoya:/paranoya/signature-base ./
sudo docker compose cp paranoya:/paranoya/signature-custom ./
And then use them as volumes:
version: '3'
services:
paranoya:
image: c0m4r/paranoya:latest
volumes:
- /tmp:/tmp
- ./signature-base:/paranoya/signature-base
- ./signature-custom:/paranoya/signature-custom
ports:
- 127.0.0.1:1337:1337
This solution isn't perfect; I haven't figured out a better one yet, but you get the idea.
License
paranoya: Simple IOC and YARA Scanner for Linux®
Copyright (c) 2015-2023 Florian Roth
Copyright (c) 2023-2024 c0m4r
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <https://www.gnu.org/licenses/>.
Linux® is the registered trademark of Linus Torvalds in the U.S. and other countries.
As with all Docker images, these likely also contain other software which may be under other licenses (such as Bash, etc from the base distribution, along with any direct or indirect dependencies of the primary software being contained).
As for any pre-built image usage, it is the image user's responsibility to ensure that any use of this image complies with any relevant licenses for all software contained within.
Funding
If you found this software helpful, please consider making donation to a charity on my behalf. Thank you.
Tag summary
Content type
Image
Digest
sha256:8853acd95…
Size
43.1 MB
Last updated
5 months ago
docker pull c0m4r/paranoya