patrolaroid - A production-friendly malware scanner for your AWS

项目说明

<p align="center">
<img src="logo.png" width="256" height="256">
</p>

<h1 align="center">Patrolaroid</h1>

<br/>

Patrolaroid is an instant camera for capturing cloud workload risks. It’s a prod-friendly scanner that makes finding security issues in AWS instances and buckets less annoying and disruptive for software engineers and cloud admins.

Patrolaroid scans production infrastructure from a safe distance rather than within production, so you don’t have to install an agent, run code, or perform other in infosec rituals to use it.

O

Patrolaroid snapshots AWS instances and buckets to unco, backdoors, cryptominers, toolkits, and other attacker tomfoolery that you probably don’t want in your prod. Software engineers, security engineers, and cloud administrators only need familiarity with YARA and the AWS Management Console to use it.

Patrolaroid does not require running an agent or code in prod, only needs read-only access to cloud assets, and generally avoids the myriad stability and performance sins of security tools.

Why?

The tired way

Most commercial “cloud security” scanners that aim to detect malware in cloud workloads ironically operate pretty similarly to malware. Their mode of operation is:
1. Just-in-time installation of an agent via SSH
2. Running the agent from /tmp
3. Deleting themselves once the scan completes

This results in the security agent stealing compute cycles and I/O from the host it’s scanning, which is unstonkly – as is the chance that prod is borked if the agent screws up.

The inspired way

Patrolaroid avoids these problems by scanning prod instances and buckets for security problems while staying safely out of prod. After the engineer or admin identifies the AWS account containing the resources they want to scan, Patrolaroid then:
1. Runs from an AWS instance within the same account as the target instances or buckets
2. Snapshots each instance
3. Uses YARA rules to scan the instance’s filesystem for matches (and generates an alert if there is a match)
4. Deletes the snapshot

In short, Patrolaroid provides "point-and-shoot" malware scanning of AWS assets without the malware-like tactics of existing “cloud security” tools.

Getting Started with Patrolaroid

All you need is an AWS account and the ability to create an AWS role and EC2 instance to get Patrolaroid up and running. Getting started in creating a dedicated EC2 instance for Patrolaroid in the same AWS account and a zones as the assets you want to scan.

Step 1: Create an AWS role

:cloud: Make sure to use the account and a zone you want to scan to create the role :cloud:
1. Log into your AWS account and access the Identity and Access Management (IAM) service in the AWS Management Console, then choose Create Role (you can also use the AWS CLI if you prefer)
2. Select AWS service for type of trusted entity
3. Select EC2 as the allowed service and use case, then choose Next: Permissions
4. Select the AmazonEC2FullAccess andAmazonS3FullAccess policies or paste our recommended policy (with tighter permissions) into the JSON editor, then choose Next: Tags
5. No tags are needed, so select Next: Review
6. Type Patrolaroid for the Role name
7. Review the role and, if satisfied, choose Create role

Step 2: Create an EC2 instance

:cloud: Make sure you’re still logged into the account you want to scan before proceeding :cloud:
1. Open the AWS EC2 console, then choose Launch instance
2. On the Step 1: Choose an Amazon Machine Image (AMI) page, select Ubuntu Server 20.04 LTS (HVM), SSD Type
3. On the Step 2: Choose an Instance Type page, select the t2.micro type, then click Next: Configure Instance Details
4. For IAM role, select the Patrolaroid role you created
5. Click Review and Launch

Step 3: Install dependencies

1. Connect to your new EC2 instance via SSH (or PuTTY if using Windows)
2. Install curl by running the command:

Step 4: Install Patrolaroid

Ensure you are connected to your dedicated EC2 instance and then download Patrolaroid to it by running:

Step 5: Run Patrolaroid

Start scanning by running Patrolaroid via sudo:

Enjoy your :cloud: :lock: :camera: :black_heart:

项目信息

开发语言：YARA

Star 数：202

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A production-friendly malware scanner for your AWS cloud展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。