# JPCERT/CC releases YAMAGoya threat hunting tool

Published: 2025-11-18 · Severity: low
Canonical: https://vorant.io/reports/3e4180bb-b216-443b-86d4-8947a2819d32/jpcert-cc-releases-yamagoya-threat-hunting-tool

> JPCERT/CC released YAMAGoya, an open-source Windows threat hunting tool that monitors endpoints in real-time using Sigma and YARA rules via ETW.

JPCERT/CC has released YAMAGoya, an open-source endpoint threat hunting tool designed to address the growing challenge of detecting fileless malware and obfuscated threats. The tool combines Event Tracing for Windows (ETW) event monitoring with memory scanning capabilities, allowing security teams to leverage community-maintained Sigma and YARA rules directly rather than relying on proprietary detection engines. YAMAGoya operates entirely in userland without requiring kernel drivers, monitoring files, processes, registry changes, DNS queries, network activity, PowerShell, and WMI events in real-time.

The tool supports both GUI and CLI interfaces and can perform correlation analysis through custom YAML rules that trigger alerts when multiple suspicious activities occur within a configurable timeframe. It outputs logs to both text files and Windows Event Log, enabling integration with existing SIEM platforms. JPCERT/CC emphasizes that YAMAGoya is a complementary tool for threat hunting and incident response, not a replacement for traditional antivirus software. The tool is available on GitHub and welcomes community contributions, though it currently lacks dedicated countermeasures against ETW bypass techniques employed by advanced attackers.

## Mentioned in this report

- Malware: Anel

Source reporting: https://blogs.jpcert.or.jp/en/2025/11/YAMAGoya.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/3e4180bb-b216-443b-86d4-8947a2819d32/jpcert-cc-releases-yamagoya-threat-hunting-tool.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup