Linux Malware Detect
Order-of-magnitude faster shell-native malware scanning for Linux
Linux Malware Detect (LMD) is a high-performance malware scanner for Linux designed around the threats faced in shared hosted environments. v2.0.1 represents a complete architectural overhaul, introducing a batch-parallel scanning engine that delivers order-of-magnitude performance gains over traditional security tools.
The scanner leverages hardware-accelerated SHA-256 (SHA-NI) and Aho-Corasick string matching to identify web shells, injected backdoors, and obfuscated payloads at wire speed. By short-circuiting matches at the hash layer, LMD avoids unnecessary content scanning, providing a massive reduction in I/O and CPU overhead.
By using threat intelligence derived from network edge intrusion detection systems, LMD generates signatures for malware that is actively being used in real-world attacks. These signatures are easily exported to ClamAV, providing a layered defense-in-depth approach for production Linux servers.
60.4k
3d
104.1k
7d
481.9k
30d
1.40M
90d
5.52M
1y
Apr 26 - Apr 29
Features
Detection Engine
- Batch-parallel Aho-Corasick engine for rapid HEX pattern matching
- Hardware-accelerated SHA-256 (SHA-NI) and MD5 hashing
- Native YARA-X integration for complex polymorphic threats
- Statistical analysis for detection of obfuscated threats (base64, gzinflate)
- Unified signature updates with ClamAV auto-export support
Real-time & Hooks
- Kernel-based inotify real-time monitoring with dynamic watch tuning
- HTTP upload scanning via ModSecurity2 inspectFile hook
- Aho-Corasick wildcard support (??, (aa|bb), *, nibble) in native engine
- Background scanner option for unattended high-throughput operations
Alerting & Integration
- Reimagined HTML+Text email alerts with unified RFXN design
- Native Discord, Slack (Block Kit), and Telegram (MarkdownV2) webhooks
- ELK Stack integration for centralized threat telemetry and dashboards
- SMTP relay support with TLS/SSL for secure alert delivery
Response & Compliance
- Quarantine queue with zero-permission storage and audit logging
- Surgical cleaner rules for removing injected malware strings
- Fully auditable shell-native source with zero-dependency design
- NIST, NATO, and AWS trusted security architecture
Installation
$ git clone https://github.com/rfxn/linux-malware-detect.git
$ cd linux-malware-detect
$ sudo ./install.shVerify Download
MD5 Signature Verification
Always verify the integrity of downloaded packages before installation.
$ wget https://www.rfxn.com/downloads/maldetect-current.tar.gz
$ wget https://www.rfxn.com/downloads/maldetect-current.tar.gz.md5
$ md5sum -c maldetect-current.tar.gz.md5Downloads & Resources
Community & Publications
Notable
Wikipedia - Linux Malware Detect
Wikipedia
LPIC-3 Exam 303 Objectives - Host Intrusion Detection (maldet)
Linux Professional Institute
LPI Learning Materials - Malware (023.3)
Linux Professional Institute
Mastering Linux Security and Hardening (Packt / O'Reilly)
O'Reilly Media
HandWiki - Linux Malware Detect
HandWiki
ArchWiki - Security Applications
ArchWiki
AUR Package - maldet
Arch User Repository
Gentoo Portage - app-antivirus/maldet
Gentoo Overlays
Puppet Forge - nexcess/maldet
Puppet Forge
GridPane Security Suite - maldet + ClamAV
GridPane
Tutorials & Articles
- Essential Linux Tools for Malware Scanning- LinuxSecurity.com
- Integrate LMD and ClamAV for Automated Malware Detection- TechRepublic
- Install LMD with ClamAV as Antivirus Engine- TecMint
- 5 Tools to Scan Linux for Malware and Rootkits- TecMint
- An Introduction to Securing Your Linux VPS- DigitalOcean
- Install LMD and ClamAV on CentOS 7- HowToForge
- Install Linux Malware Detect on Ubuntu 20.04- Liquid Web
- Install and Use Linux Malware Detect- ComputingForGeeks
- How to Detect and Clean Malware from a Linux Server- Make Tech Easier
- Introduction to Maldet and ClamAV Scanning- GridPane
- Easily Integrate Linux Malware Detect with ClamAV- kifarunix
- Install and Configure LMD on Linux- UbuntuPit
Community
- cPanel WHM Addon for Maldet- GitHub
- Ansible Role - cloudweeb.maldet- GitHub
- LPIC-3 Security 303-300 Study Guide (maldet)- GitHub
- Centmin Mod - Maldet Addon Discussion- Centmin Mod Forums
- Linux Malware Detect on DirectAdmin- DirectAdmin Forums
- WordPress Security: Securing Multiple Banking Websites- GridPane