Linux Malware Detect
Order-of-magnitude faster shell-native malware scanning for Linux
Linux Malware Detect (LMD) is a high-performance malware scanner for Linux designed around the threats faced in shared hosted environments. v2.0.1 represents a complete architectural overhaul, introducing a batch-parallel scanning engine that delivers order-of-magnitude performance gains over traditional security tools.
The scanner leverages hardware-accelerated SHA-256 (SHA-NI) and Aho-Corasick string matching to identify web shells, injected backdoors, and obfuscated payloads at wire speed. By short-circuiting matches at the hash layer, LMD avoids unnecessary content scanning, providing a massive reduction in I/O and CPU overhead.
By using threat intelligence derived from network edge intrusion detection systems, LMD generates signatures for malware that is actively being used in real-world attacks. These signatures are easily exported to ClamAV, providing a layered defense-in-depth approach for production Linux servers.
62.8k
3d
108.4k
7d
501.4k
30d
1.46M
90d
5.75M
1y
Apr 6 — Apr 9
Features
Detection Engine
- Batch-parallel Aho-Corasick engine for rapid HEX pattern matching
- Hardware-accelerated SHA-256 (SHA-NI) and MD5 hashing
- Native YARA-X integration for complex polymorphic threats
- Statistical analysis for detection of obfuscated threats (base64, gzinflate)
- Unified signature updates with ClamAV auto-export support
Real-time & Hooks
- Kernel-based inotify real-time monitoring with dynamic watch tuning
- HTTP upload scanning via ModSecurity2 inspectFile hook
- Aho-Corasick wildcard support (??, (aa|bb), *, nibble) in native engine
- Background scanner option for unattended high-throughput operations
Alerting & Integration
- Reimagined HTML+Text email alerts with unified RFXN design
- Native Discord, Slack (Block Kit), and Telegram (MarkdownV2) webhooks
- ELK Stack integration for centralized threat telemetry and dashboards
- SMTP relay support with TLS/SSL for secure alert delivery
Response & Compliance
- Quarantine queue with zero-permission storage and audit logging
- Surgical cleaner rules for removing injected malware strings
- Fully auditable shell-native source with zero-dependency design
- NIST, NATO, and AWS trusted security architecture
Installation
$ git clone https://github.com/rfxn/linux-malware-detect.git
$ cd linux-malware-detect
$ sudo ./install.shVerify Download
MD5 Signature Verification
Always verify the integrity of downloaded packages before installation.
$ wget https://www.rfxn.com/downloads/maldetect-current.tar.gz
$ wget https://www.rfxn.com/downloads/maldetect-current.tar.gz.md5
$ md5sum -c maldetect-current.tar.gz.md5Downloads & Resources
Community & Publications
Notable
Wikipedia — Linux Malware Detect
Wikipedia
LPIC-3 Exam 303 Objectives — Host Intrusion Detection (maldet)
Linux Professional Institute
LPI Learning Materials — Malware (023.3)
Linux Professional Institute
Mastering Linux Security and Hardening (Packt / O'Reilly)
O'Reilly Media
HandWiki — Linux Malware Detect
HandWiki
ArchWiki — Security Applications
ArchWiki
AUR Package — maldet
Arch User Repository
Gentoo Portage — app-antivirus/maldet
Gentoo Overlays
Puppet Forge — nexcess/maldet
Puppet Forge
GridPane Security Suite — maldet + ClamAV
GridPane
Tutorials & Articles
- Essential Linux Tools for Malware Scanning— LinuxSecurity.com
- Integrate LMD and ClamAV for Automated Malware Detection— TechRepublic
- Install LMD with ClamAV as Antivirus Engine— TecMint
- 5 Tools to Scan Linux for Malware and Rootkits— TecMint
- An Introduction to Securing Your Linux VPS— DigitalOcean
- Install LMD and ClamAV on CentOS 7— HowToForge
- Install Linux Malware Detect on Ubuntu 20.04— Liquid Web
- Install and Use Linux Malware Detect— ComputingForGeeks
- How to Detect and Clean Malware from a Linux Server— Make Tech Easier
- Introduction to Maldet and ClamAV Scanning— GridPane
- Easily Integrate Linux Malware Detect with ClamAV— kifarunix
- Install and Configure LMD on Linux— UbuntuPit
Community
- cPanel WHM Addon for Maldet— GitHub
- Ansible Role — cloudweeb.maldet— GitHub
- LPIC-3 Security 303-300 Study Guide (maldet)— GitHub
- Centmin Mod — Maldet Addon Discussion— Centmin Mod Forums
- Linux Malware Detect on DirectAdmin— DirectAdmin Forums
- WordPress Security: Securing Multiple Banking Websites— GridPane