linux-malware-detect (LMD) is a GPL-2.0 shell-based malware scanner that combines MD5, SHA-256, HEX, compound, YARA and statistical detection stages for defenders securing shared-hosting and server environments.
| Tool | rfxn/linux-malware-detect — multi-stage Linux malware scanner with ClamAV integration and real-time inotify monitoring, version 2.0.1 |
| Category | Host-based malware detection and file monitoring (Shell/Bash) |
| Primary Use | Scanning web roots and user directories for PHP shells, base64 backdoors and injected JavaScript via maldet -a and maldet -m on servers you administer |
| Safe Use | Deploying on hosts and shared-hosting platforms you own or are contracted to administer, for incident triage, scheduled hygiene scans and defensive research in lab environments |
| Telemetry Note | Purely defensive; it leaves scan session logs, quarantine stores and alert messages, and its inotify monitors and cron jobs are visible in process lists and /etc/cron.daily/maldet |
rfxn/linux-malware-detect, almost universally referred to as LMD, is a long-lived malware scanner for Linux distributed under GPL-2.0 and written primarily in Shell. Now at version 2.0.1, the project sits at roughly 1,500 GitHub stars and is one of the few open-source scanners built specifically around the threat profile of shared hosting environments. Rather than chasing OS-level implant families, LMD's signature corpus is derived from threat data captured at network-edge intrusion detection systems, user submissions via its checkout feature, and community malware resources — meaning it is tuned to the PHP web shells, JavaScript injectors, base64-encoded backdoors and IRC bots that dominate real-world compromises of hosting accounts.
The headline change in 2.0.1 is a claimed 43x speedup of the native scan engine, and the README backs it with a concrete benchmark: roughly 10,000 files scanned in 1,217 seconds under v1.6.6 versus 28 seconds under 2.0.1, with identical hit counts of 35. The rewrite replaces per-file pattern compilation with batch grep powered by Aho-Corasick parallel workers, eliminating what the author describes as about 500,000 subprocess forks per scan. Worker count is tunable via the scan_workers option, which defaults to automatic sizing. For anyone who abandoned LMD years ago because large web roots took twenty minutes to traverse, this is the change that makes daily full-surface scanning practical again.
Detection is organized into five distinct stages, and the architecture is worth understanding because it explains where LMD's coverage overlaps and diverges from conventional antivirus. Stage one is exact hash matching, now supporting both MD5 and SHA-256 with CPU hardware auto-detection through scan_hashtype. Stage two is HEX pattern matching via the batch engine. Stage three, compound signatures (csig), is the most interesting: multi-pattern boolean logic with AND/OR and threshold semantics, case-insensitive matching, UTF-16LE wide-string support, and bounded gap wildcards — effectively a lightweight content-correlation language for describing families rather than single bytes. Stage four is native YARA scanning with full module support and custom rules enabled via scan_yara=1. Stage five is statistical string-length analysis aimed at obfuscated payloads such as base64 and gzinflate blobs that evade signature matching entirely.
ClamAV integration rounds out coverage: the installer automatically links LMD-maintained signatures into ClamAV's data directories when both are present, giving dual-engine detection from a single signature feed. There is also a remote ClamAV mode documented in the configuration sections, plus an ELK integration path for teams that want scan telemetry flowing into a centralized stack. This positioning matters — LMD is not competing with your EDR; it is a cheap, host-local supplement that catches web-layer threats commercial agents frequently score poorly on.
Installation is a single non-interactive script: ./install.sh drops everything into /usr/local/maldetect, symlinks the maldet binary into /usr/local/sbin/, installs the daily cron job at /etc/cron.daily/maldet, and installs a systemd service unit (or a SysV init script on legacy systems). Existing configuration in conf.maldet, custom signatures and ignore files are preserved across upgrades, and previous installs are backed up to /usr/local/maldetect.bk{PID} with a maldetect.last pointer — a small detail, but one that shows operational maturity. Supported platforms span RHEL/Rocky/AlmaLinux 8 through 10, CentOS 6/7, Debian 10–12, Ubuntu 20.04–24.04, Gentoo and Slackware, with partial FreeBSD support lacking inotify.
Daily operation centers on the maldet CLI. A full sweep of hosting web roots looks like maldet -a /home/?/public_html, while the regression-friendly variant maldet -r /home/?/public_html 2 limits scanning to files modified in the last two days — the same logic the daily cron applies with scan_days=1. Scan lifecycle management is new: --kill, --pause, --stop and --continue plus the -L listing flag let an operator manage long background jobs without resorting to process butchery. Runtime configuration overrides via -co are convenient for one-off tuning, for example enabling YARA for a single scan without editing conf.maldet.
Real-time monitoring uses kernel inotify watches on create, modify and move events, started with maldet -m users to cover hosting users' paths. There is also an HTTP upload hook: ModSecurity2's inspectFile mechanism can invoke LMD on files at upload time, which is exactly where you want detection in a shared-hosting pipeline — before a dropped web shell ever lands on disk. Resource controls (nice, ionice, cpulimit) and scan_max_depth, scan_min_filesize and scan_max_filesize bounds keep scans from starving production workloads, with sensible defaults like a 2048k maximum file size.
When hits land, LMD offers a quarantine queue with zero-permission file storage, batch quarantine and restore keyed by scan ID (maldet -q SCANID), and signature-specific cleaner rules that can strip malicious injections rather than deleting whole files. Restoration is genuinely thorough — content, ownership, permissions and mtime are all recovered — which matters when a cleaner rule misfires on a legitimate file. Quarantine retention is governed by cron_prune_days at a default of 21 days.
Alerting has been modernized well beyond the legacy email-only model. Alongside HTML/text email with SMTP relay support (smtps:// with authentication via smtp_user/smtp_pass), version 2.0.1 ships Slack Block Kit uploads, Telegram MarkdownV2 messages and Discord webhook embeds, each configurable through conf.maldet with token variables like slack_token and telegram_bot_token. Customizable templates under alert/custom.d/ let blue teams align alerts with existing incident channels, and the README documents control-panel-aware user alerts (email_panel_user_alerts) with auto-detection for twelve-plus hosting panels.
Signature hygiene is largely automatic: autoupdate_signatures and autoupdate_version run daily through cron, sigup_interval (default 6 hours) drives an independent update job at /etc/cron.d/maldet-sigup, and autoupdate_version_hashed verifies the executable's SHA-256 against upstream before self-updating — a hardening touch that closes the obvious supply-chain objection to auto-updating scanners. Custom signatures import cleanly from remote URLs for every stage (sig_import_md5_url, sig_import_hex_url, sig_import_yara_url, sig_import_sha256_url, sig_import_csig_url), so a team can maintain a private feed alongside the public corpus.
For authorized defenders, LMD earns its place as the pragmatic middle ground between commercial EDR and manual YARA sweeps: deploy it on servers you administer, wire the alerts into Slack or an ELK cluster, and let the cron and inotify layers catch web-shell droplets that other tooling misses. From a detection-engineering standpoint, the compound-signature language and statistical obfuscation heuristics are also worth reading as a design study — and the 43x engine rewrite in 2.0.1 makes the whole package considerably harder to ignore.
rfxn/linux-malware-detect.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.