Linux Malware Detect (LMD)

Malware scanner for Linux — multi-stage threat detection (MD5, HEX, YARA, statistical analysis), ClamAV integration, real-time inotify monitoring, quarantine/clean/restore operations, and multi-channel alerting (email, Slack, Telegram).

(C) 2002-2026, R-fx Networks <proj@rfxn.com>
(C) 2026, Ryan MacDonald <ryan@rfxn.com>
Licensed under GNU GPL v2

---

Contents

• 1. Introduction
• 2. Installation
• 3. Configuration
  • 3.1 General Options
  • 3.2 Alerting
  • 3.3 Scanning Options
  • 3.4 YARA Scanning
  • 3.5 Quarantine Options
  • 3.6 Monitoring Options
  • 3.7 ClamAV Integration
  • 3.8 Remote ClamAV
  • 3.9 ELK Integration
  • 3.10 Configuration Loading Order
• 4. CLI Usage
• 5. Ignore Options
• 6. Cron Daily
• 7. Inotify Monitoring
• 8. Signature System
  • 8.1 Signature Updates
  • 8.2 Custom Signatures
• 9. Quarantine & Cleaning
  • 9.1 Cleaner Rules
• 10. ModSecurity2 Upload Scanning
• 11. License
• 12. Support Information

---

Quick Start

# Install to /usr/local/maldetect
./install.sh

# Scan all files under a path
maldet -a /home/?/public_html

# Scan files modified in the last 2 days
maldet -r /home/?/public_html 2

# Enable YARA scanning at runtime
maldet -co scan_yara=1 -a /home/?/public_html

# Quarantine all hits from a scan
maldet -q SCANID

# Start real-time inotify monitoring
maldet -m users

# Update signatures
maldet -u

---

1. Introduction

Linux Malware Detect (LMD) is a malware scanner for Linux released under the GNU GPLv2 license, designed around the threats faced in shared hosted environments. It uses threat data from network edge intrusion detection systems to extract malware that is actively being used in attacks and generates signatures for detection. In addition, threat data is derived from user submissions with the LMD checkout feature and from malware community resources.

LMD focuses on the malware classes that traditional AV products frequently miss: PHP shells, JavaScript injectors, base64-encoded backdoors, IRC bots, and other web-application-layer threats that target shared hosting user accounts rather than operating system internals.

Detection Stages

• MD5 file hash matching for exact threat identification
• HEX pattern matching for identifying threat variants and families
• Native YARA rule scanning with full module support and custom rules
• Statistical string-length analysis for detecting obfuscated threats (base64, gzinflate)
• ClamAV integration for extended coverage with LMD-maintained ClamAV signatures

Scanning & Monitoring

• Scan all files, recently modified files, or files from a list
• Kernel inotify real-time file monitoring (create/modify/move events)
• HTTP upload scanning via ModSecurity2 inspectFile hook
• Background scanning for unattended large-scale operations
• Per-scan include/exclude regex filtering

Quarantine & Response

• Quarantine queue with zero-permission file storage
• Batch quarantine/restore by scan ID
• Signature-specific cleaner rules for malware removal
• Full file restoration (content, owner, permissions, mtime)

Alerting & Reporting

• Email alerts per scan or daily digest
• Slack alerting via Bot API (files.getUploadURLExternal)
• Telegram alerting via Bot API (sendDocument)
• Scan reports with per-file hit details

Infrastructure

• Automatic ClamAV signature linking for dual-engine coverage
• Daily cron with auto-detection of 12+ hosting control panels
• CPU/IO resource control (nice, ionice, cpulimit)
• Signature and version auto-updates
• systemd service unit and SysV init script support

Supported Platforms

LMD runs on any Linux distribution with bash and standard GNU utilities. Tested platforms:

---

2. Installation

The included install.sh script handles all installation tasks. Previous installations are automatically backed up.

./install.sh

The installer:

• Copies files to /usr/local/maldetect
• Creates the maldet symlink in /usr/local/sbin/
• Installs the cron.daily script to /etc/cron.daily/maldet
• Installs the systemd service unit (or SysV init script on older systems)
• Links LMD signatures to ClamAV data directories (if ClamAV is installed)
• Preserves existing configuration (conf.maldet), custom signatures, and ignore files across upgrades

Previous installs are saved to /usr/local/maldetect.bk{PID} with a maldetect.last symlink to the most recent backup.

Default paths:

• Install path: /usr/local/maldetect
• Binary symlink: /usr/local/sbin/maldet
• Cron script: /etc/cron.daily/maldet
• Service unit: /usr/lib/systemd/system/maldet.service

---

3. Configuration

The main configuration file is /usr/local/maldetect/conf.maldet. All options are commented for ease of configuration. Options use 0/1 for disable/enable unless otherwise noted.

Configuration can also be overridden at runtime using the -co flag:

maldet -co quarantine_hits=1,email_addr=you@domain.com -a /home

3.1 General Options

3.2 Alerting

3.3 Scanning Options

3.4 YARA Scanning

Native YARA scanning invokes the yara binary (or yr from YARA-X) independently of ClamAV, supporting full YARA modules, compiled rules, and custom rule files that ClamAV's limited YARA subset cannot handle. When both are available, yr (YARA-X) is preferred.

Custom YARA rules can be placed in two locations, both preserved across upgrades:

• sigs/custom.yara — single-file rules
• sigs/custom.yara.d/ — drop-in directory for .yar and .yara rule files

Compatible with third-party rule sets such as YARA Forge and Signature Base. Compiled rules (yarac output) are also supported via sigs/compiled.yarc.

Batch scanning: YARA 4.0+ and all YARA-X versions use --scan-list for efficient batch file scanning. Older YARA versions fall back to per-file scanning automatically.

Enable at runtime without editing config:

maldet -co scan_yara=1 -a /home/?/public_html

3.5 Quarantine Options

3.6 Monitoring Options

3.7 ClamAV Integration

When scan_clamscan=1, LMD selects the best available ClamAV engine in priority order:

1. Remote clamdscan (if scan_clamd_remote=1 and config exists)
2. Local clamd daemon running as root
3. Local clamd daemon running as non-root (with --fdpass)
4. clamscan binary (fallback, slower)

LMD signatures are automatically symlinked to ClamAV data directories by install.sh, giving ClamAV access to LMD's MD5 (rfxn.hdb), HEX (rfxn.ndb), and YARA (rfxn.yara) signatures.

3.8 Remote ClamAV

3.9 ELK Integration

3.10 Configuration Loading Order

Later sources override earlier values:

1. internals/internals.conf — internal paths, binary discovery, URL definitions
2. conf.maldet — user-facing configuration
3. internals/compat.conf — deprecated variable mappings
4. /etc/sysconfig/maldet or /etc/default/maldet — system overrides
5. CLI -co|--config-option — runtime overrides

---

4. CLI Usage

usage: maldet [OPTION] [ARGUMENT]

SCANNING:
  -a, --scan-all PATH           scan all files in path (wildcard: ?)
  -r, --scan-recent PATH DAYS   scan files created/modified in last X days
  -f, --file-list FILE          scan files from a line-separated file list
  -b, --background              run scan in the background

SCAN FILTERS:
  -i, --include-regex REGEX     include only matching paths
  -x, --exclude-regex REGEX     exclude matching paths
  -co, --config-option V=V,...  override config options at runtime
  -U, --user USER               run as specified user

MONITORING:
  -m, --monitor USERS|PATHS|FILE  start inotify real-time monitoring
  -k, --kill-monitor            stop inotify monitoring

QUARANTINE & RESTORE:
  -q, --quarantine SCANID       quarantine hits from scan
  -n, --clean SCANID            clean malware from scan hits
  -s, --restore FILE|SCANID     restore quarantined file(s)

REPORTING:
  -e, --report [SCANID] [email] view or email scan report
  -E, --dump-report SCANID      dump report to stdout
  -l, --log                     view event log

UPDATES:
  -u, --update-sigs [--force]   update malware signatures
  -d, --update-ver [--force|--beta]  update LMD version

OTHER:
  -p, --purge                   clear logs, quarantine, temp data
  -c, --checkout FILE           submit suspected malware to rfxn.com
  --web-proxy IP:PORT           set HTTP/HTTPS proxy
  -h, --help                    show detailed help

Exit codes: 0 = success / no hits, 1 = error, 2 = malware hits found.

Examples:

# Scan all files under user web roots
maldet -a /home/?/public_html

# Scan recent files with auto-quarantine and YARA enabled
maldet -co quarantine_hits=1,scan_yara=1 -r /home/?/public_html 2

# Background scan with email alert to specific address
maldet -b -co email_addr=admin@example.com -a /var/www

# View the most recent scan report
maldet -e

# Email a specific report
maldet -e 050910-1534.21135 admin@example.com

# Restore all quarantined files from a scan
maldet -s 050910-1534.21135

---

5. Ignore Options

Four ignore files control what is excluded from scanning:

All ignore files are located under /usr/local/maldetect/.

Examples:

# ignore_paths
/home/user/public_html/cgi-bin

# ignore_file_ext
.js
.css

# ignore_sigs
base64.inject.unclassed

# ignore_inotify
^/home/user$
^/var/tmp/#sql_.*\.MYD$

Note: ignore_sigs entries are treated as extended regex patterns and match as substrings. An entry php.shell will suppress php.shell, php.shell.v2, {YARA}php.shell.backdoor, etc. Use ^php\.shell$ for an exact match. The . character matches any character in regex; escape it as \. for a literal dot.

---

6. Cron Daily

The cron job installed at /etc/cron.daily/maldet performs three tasks:

1. Prune quarantine, session, and temp data older than cron_prune_days (default: 21)
2. Update signatures and version (when autoupdate_signatures and autoupdate_version are enabled)
3. Scan recently modified files under detected hosting panel paths

The daily scan auto-detects installed control panels and adjusts scan paths accordingly:

If monitor mode is active, daily scans are skipped and a daily report of monitoring events is issued instead.

For custom scan paths, use the hook file /usr/local/maldetect/cron/custom.cron. For configuration overrides specific to cron, use /etc/sysconfig/maldet (RHEL) or /etc/default/maldet (Debian) or /usr/local/maldetect/cron/conf.maldet.cron.

A weekly watchdog script (/etc/cron.weekly/maldet-watchdog) provides independent fallback signature updates when the primary cron is broken or stale.

---

7. Inotify Monitoring

Real-time file monitoring uses the kernel inotify subsystem to detect file creation, modification, and move events. Requires a kernel with CONFIG_INOTIFY_USER (standard on all modern kernels).

# Monitor all user home directories (UIDs >= inotify_minuid)
maldet -m users

# Monitor specific paths
maldet -m /home/mike,/home/ashton

# Monitor paths from a file
maldet -m /root/monitor_paths

# Stop monitoring
maldet -k

How it works:

1. monitor_init() sets up inotify watches on all files under monitored paths
2. File events are queued and batch-scanned every inotify_sleep seconds (default: 15)
3. Configuration is reloaded every inotify_reloadtime seconds (default: 3600)
4. Kernel max_user_watches and max_user_instances are auto-tuned for optimal performance

When using the users mode, only subdirectories matching inotify_docroot (default: public_html,public_ftp) are monitored, plus the system temp directories /tmp, /var/tmp, and /dev/shm.

Alerting in monitor mode uses daily digest reports via the cron job rather than per-file alerts.

---

8. Signature System

LMD ships with three signature types:

ClamAV-compatible signatures are also maintained:

• sigs/rfxn.hdb — ClamAV MD5 format
• sigs/rfxn.ndb — ClamAV HEX format

Signature naming convention: {TYPE}category.name.variant_number

Categories include: bin. (binary), c. (C language), exp. (exploit), php. (PHP), js. (JavaScript), perl. (Perl), html. (phishing), base64.inject., gzbase64.

Hit prefixes in scan reports:

8.1 Signature Updates

Signatures are updated daily via the cron job or manually:

maldet -u            # update signatures
maldet -u --force    # force update even if current

8.2 Custom Signatures

Custom signatures can be added in three formats, all preserved across upgrades:

Remote import URLs can be configured for automatic download during signature updates:

---

9. Quarantine & Cleaning

Quarantined files are stored under /usr/local/maldetect/quarantine/ with permissions set to 000. Original path, owner, permissions, and modification time are recorded in quarantine.hist for full restoration.

# Quarantine all hits from a scan
maldet -q SCANID

# Restore all quarantined files from a scan
maldet -s SCANID

# Restore a specific file
maldet -s /usr/local/maldetect/quarantine/config.php.23754

# Clean (attempt malware removal) from a scan
maldet -n SCANID

Quarantine file naming: YYYYMMDD-HH-SIGNATURE-SCANPID.INODE

For non-root scans (e.g., ModSecurity2 upload scanning), quarantine data is stored under /usr/local/maldetect/pub/USERNAME/quar/. Use the -U flag to interact with non-root quarantine:

maldet -U nobody -s 112012-0032.13771

9.1 Cleaner Rules

The cleaner function looks for signature-named scripts under the clean/ directory. Each script receives the infected file path as an argument and should strip the malicious content. After cleaning, the file is rescanned — if it still triggers a hit, the clean is marked FAILED.

To create a clean rule for signature php.cmdshell.r57, add a file clean/php.cmdshell.r57 containing a command like sed -i with the appropriate pattern. Successful cleans restore the file to its original path, owner, and permissions.

The cleaner is a sub-function of quarantine — files must be quarantined (or use -n) for cleaning to execute.

---

10. ModSecurity2 Upload Scanning

LMD integrates with ModSecurity2's inspectFile hook for real-time HTTP upload scanning via the included hookscan.sh script.

Setup:

1. Enable user access scanning in conf.maldet:

   scan_user_access=1
   

2. Add to your ModSecurity2 configuration:

   SecRequestBodyAccess On
   SecRule FILES_TMPNAMES "@inspectFile /usr/local/maldetect/hookscan.sh" \
       "id:'999999',log,auditlog,deny,severity:2,phase:2,t:none"
   

   For ModSecurity >= 2.9, add SecTmpSaveUploadedFiles On before the rule.

3. Restart Apache.

Malicious uploads are rejected with a 406 status code and logged to the ModSecurity audit log. The default scan options prioritize performance over accuracy (native engine only, no ClamAV, quarantine enabled). Edit hookscan.sh to customize. To enable YARA scanning for uploads, set scan_yara=1 in conf.maldet.hookscan (separate from the main conf.maldet).

Run maldet --mkpubpaths after enabling to create per-user data directories for non-root scan operations.

---

11. License

LMD is developed and supported on a volunteer basis by Ryan MacDonald [ryan@rfxn.com].

Linux Malware Detect (LMD) is distributed under the GNU General Public License (GPL) v2 without restrictions on usage or redistribution. The copyright statement and GNU GPL are included in the COPYING.GPL file. Credit must be given for derivative works as required under GNU GPL.

---

12. Support Information

The LMD source repository is at: https://github.com/rfxn/linux-malware-detect

Bugs, feature requests, and general questions can be filed as GitHub issues or sent to proj@rfxn.com.

The official project page is at: https://www.rfxn.com/projects/linux-malware-detect/