Yep; indeed, Volatility itself has a plugin called `yarascan` that will tell you about any hits on Yara signatures inside of a memory image. https://code.googl

Yep; indeed, Volatility itself has a plugin called `yarascan` that will tell you about any hits on Yara signatures inside of a memory image. https://code.google.com/p/volatility/wiki/CommandReferenceMal23#yarascan https://code.google.com/p/volatility/wiki/CommandReferenceMa... Edit: Also, this approach is basically how the Detekt [1] tool works -- it loads Volatility and scans process memory using its own set of Yara rules. [1] https://resistsurveillance.org/ https://resistsurveillance.org/