technical deep dive · march 2026

sigforge

Signature Intelligence for
Malware Defense

sample intake · classification · generation · distribution · rollout

R rfxn

architecture · 9-stage pipeline

From raw samples to deployed signatures in one pipeline.

1
Collect
Fetch from feeds (FTP, MalwareBazaar, URLhaus)
2
Import
Intake to queue with dedup + metadata sidecars
3
Dedup
Match queue against classified (O(1) lookups)
4
Classify
Auto-classify: hash → ClamAV → YARA → heuristic
5
Regen
Regenerate sig_base via single-pass awk pipelines
6
Export
Generate ClamAV NDB/HDB, YARA, sigpack formats
7
Validate
Format checks + ClamAV compile + YARA compile + FP gate
8
Distribute
Push to LMD repo, CDN, remote hosts
9
Stats
Record run statistics + version stamp
R rfxn
SIGFORGE PIPELINE ARCHITECTURE feeds → incoming → queue → classified → sig_base → sigs → CDN COLLECT 3 feed modules FTP · API · URLhaus state tracking IMPORT + DEDUP batch MD5/SHA256 O(1) array dedup .meta sidecars CLASSIFY 6-stage cascade hash→ClamAV→YARA fuzzy→heuristic→LLM REGEN + EXPORT single-pass awk atomic writes 6 sig formats DISTRIBUTE LMD repo + CDN canary/stable gate rsync + checksums hex.dat ~20K hex patterns md5v2.dat ~11K MD5 hashes sha256v2.dat ~11K SHA-256 rfxn.ndb ClamAV NDB rfxn.yara 3,700+ YARA rules sigpack.tgz LMD distribution intake processing distribution
R rfxn
CLASSIFICATION CASCADE first match wins · confidence scored · 6 stages 1 HASH MATCH confidence: 4 MD5 + SHA-256 lookup exact threat ID miss 2 CLAMAV BATCH confidence: 3 clamdscan --fdpass batch file list miss 3 YARA BATCH confidence: 3 yara -r recursive scan 3,700+ rules 4 FUZZY HASH confidence: 2-3 ssdeep corpus comparison threshold 60-80 miss 5 HEURISTIC confidence: 2-3 regex patterns obfuscation detect miss 6 LLM TRIAGE confidence: 1 Claude / Gemini API cost-tracked CLASSIFIED/ {platform} .{type} .{family} [.variant] + .meta sidecar + vendor_origin + confidence score match match match
R rfxn

signature formats · 7 output types

One pipeline, seven signature formats.

FormatStructurePurpose
hex.dat HEXSTRING:{HEX}name.seq Hex byte patterns
md5v2.dat MD5:SIZE:{MD5}name.seq MD5 hash + file size
sha256v2.dat SHA256:SIZE:{SHA256}name.seq SHA-256 hash + size
csig.dat SIGS:{CSIG}name.seq Compound AND/OR logic
rfxn.ndb {HEX}name:0:*:HEXSTRING ClamAV hex database
rfxn.hdb MD5:SIZE:name.seq ClamAV MD5 database
rfxn.yara rule Name { strings... } YARA rule format
2,297 hex signatures
41,427 MD5 hashes
39,378 SHA-256 hashes
3,706 YARA rules
R rfxn

taxonomy · structured naming

{platform}.{type}.{family}[.variant]

Platforms (19)

php
perl
python
js
shell
bin
multi
+ 12 more

Types (30+)

webshell
backdoor
dropper
ransomware
stealer
miner
+ 24 more

Examples

php.webshell.c99
perl.backdoor.ircbot
bin.trojan.generic
python.stealer.agent
js.miner.coinhive
shell.dropper.wget

3-tier vendor normalization: explicit map → wildcard → inference

R rfxn

quality gates · zero false positives

Every signature passes four validation gates before release.

1

Format Validation

Field structure verification, hex character validation, tag prefix consistency, line count checks

2

ClamAV Compile

clamscan --compile against staging database. Cross-version: ClamAV 0.103 through 1.4.x

3

YARA Compile

yara -c rule compilation check. Validates syntax, string definitions, and condition logic

4

FP Gate

Scan 142K benign files (WordPress, Joomla, Drupal core). Zero hits required to pass

R rfxn
STAGED ROLLOUT ARCHITECTURE canary → stable · percentage gate · pin overrides SIGFORGE sf sig distribute sf sig promote sigpack.tgz sigs.ver + checksums rsync promote CDN canary/ latest sigs immediate push stable/ promoted sigs after validation promote --stable sigs.ver (version signal) .pct gate (rollout %) .pin overrides LMD CLIENTS 0 - 50% canary channel salted IP hash gate 50 - 100% stable channel proven signatures PIN OVERRIDES per-IP channel lock · /etc/rollout/lmd-pin.dat sf sig distribute push canary sf sig promote --channel stable sf rollout set --pct 50 sf rollout pin --ip 1.2.3.4 canary
R rfxn

part two

LMD 2.x

Linux Malware Detect

multi-engine detection · real-time monitoring · 4-channel alerting · SIEM audit logging

R rfxn

lmd 2.x · performance

43x faster. Same signatures. Same coverage.

v2.0.1 vs v1.6.6 — 9,931 files

28s v2.0.1 — parallel batch workers 1,217s v1.6.6 — sequential per-file scanning

43x improvement from batch Aho-Corasick workers, parallel xargs -P, single-pass awk pipelines, and fused hash walks.

Architecture Changes

  • Parallel batch grep with 2–8 workers per CPU
  • Single clamscan -f (batch) vs per-file invocation
  • Single yara -r (recursive) vs per-file invocation
  • Fused MD5+SHA-256 hash walk (one find pass)
  • Auto-detect scan_hashtype (SHA-NI acceleration)
  • inotify 15s micro-batch vs per-event scan
R rfxn

lmd 2.x · benchmark · sigforge custom corpus

Real-world scanner benchmark: 6,002 samples.

SCANNERDETECTMISSEDRATETIMEFILES/sMEMCPUIO_RIMG
ClamAV 1,045 4,957 17.4% 69s 86 998 MB 66s 673 MB 277 MB
ClamDAV 1,045 4,957 17.4% 17s 353 1,060 MB 58s 663 MB 245 MB
LMD 2.x 2,206 3,796 36.7% 13s 461 44 MB 60s 178 MB 190 MB

sf benchmark run --scanners clamav,clamdav,lmd --corpus custom --parallel 1 · 6,002 files · Docker isolation

2.1x
higher detection rate than ClamAV
5.3x
faster than ClamAV clamscan
22x
less memory than ClamAV
461
files/sec — highest throughput
R rfxn
LMD 2.x MULTI-ENGINE ARCHITECTURE 43x faster than v1.6 · parallel batch workers · auto-engine detection FILE LIST path enumeration inotify watch cron schedule --scan-all --scan-recent -m (monitor) STAGE 1 HASH (MD5/SHA-256) parallel workers · O(1) array lookup 2-8 workers STAGE 2 HEX + CSIG batch pattern match · compound sigs 2-8 workers STAGE 3 ClamAV clamdscan / clamscan · rfxn.ndb + rfxn.hdb auto-detect STAGE 4 YARA native yara / yr · rfxn.yara rules auto-detect STAGE 5 String Analysis obfuscation detect · encoding checks 2-8 workers SESSION session.tsv hit aggregation dedup + scoring TSV v1 format audit logging RESPONSE quarantine clean alert SIEM log 5 detection stages • parallel batch workers • 4-channel response •
R rfxn
lmd 2.x · signature consumption

How LMD consumes sigforge signatures.

1
Check version — compare local maldet.sigs.ver against CDN (every 6h via cron)
2
Download — fetch maldet-sigpack.tgz + SHA-256 sidecar verification
3
Extract — to /usr/local/maldetect/sigs/ (preserves custom sigs)
4
Deploy — symlink to ClamAV data dirs + SIGUSR2 reload
5
Ready — all engines pick up new sigs on next scan
6h update interval
8 sig file types consumed
86K+ total signatures
R rfxn
lmd 2.x · customization

Full operator control over signatures and exclusions.

Custom Signatures

  • custom.md5.dat, custom.hex.dat, custom.sha256.dat
  • custom.csig.dat — compound boolean logic
  • custom.yara + custom.yara.d/ — per-rule files
  • Remote import via sig_import_*_url — fleet-wide push

Ignore & Allowlists

  • ignore_sigs — exclude signature names
  • ignore_paths — exclude file paths
  • ignore_file_ext — exclude extensions
  • ignore_inotify — exclude from monitoring

All custom files preserved across signature updates.

R rfxn
lmd 2.x · scanning modes

Three modes. One detection pipeline.

ON-DEMAND SCANNING

maldet -a /path — full directory scan
maldet -r /path 7 — files modified in last N days
maldet -f filelist — scan from file list
Parallel batch workers: 2–8 auto-scaled per CPU core
Include/exclude regex filters (-i, -x)
Runtime config override: -co scan_hexdepth=1048576
Background mode: -b for non-blocking execution

REAL-TIME MONITORING

maldet -m users — watch all user homedirs
maldet -m /path,/path2 — watch specific paths
Linux inotify kernel-level file event watching
15-second micro-batch scan interval
Per-user docroot scoping (public_html, public_ftp)
Digest alerts: periodic summaries (Nh/Nm/Nd intervals)
Escalation threshold: immediate alert at N hits

SCHEDULED (CRON)

cron.daily — automatic web directory scan
cron.d/maldet-sigup — signature updates
Recent files only (configurable scan_days)
Signature auto-update every 6 hours
Version auto-update with hash verification
Session/quarantine auto-prune after 21 days
Hook scanning: ModSecurity2 + FTP upload triggers
R rfxn
DETECTION & RESPONSE PIPELINE scan → quarantine → clean / suspend → alert SCAN 5 detection stages 2-8 parallel workers maldet -a /path hits QUARANTINE chmod 000 + root:root .info metadata sidecar original path, owner, permissions preserved CLEAN sig-matched clean rules rescan all 5 stages re-quarantine on failure quarantine_clean=1 SUSPEND cPanel: account suspend non-cPanel: /bin/false minuid=500 safety quarantine_suspend_user=1 ALERT Email · Slack · Telegram · Discord HTML + text multipart reports per-panel-user alerts digest mode for monitoring RESTORE maldet -s SCANID original perms + owner exit 0 = clean · exit 2 = hits found · exit 1 = error
R rfxn

lmd 2.x · alert pipeline

Four delivery channels. One shared alert API.

EMAIL

HTML + text multipart (MIME builder)
SMTP relay: smtps://host:465
Per-panel-user alerts (cPanel, Plesk, Interworx)
Suppress-if-cleaned: email_ignore_clean=1
Custom from/reply-to for hosting providers

SLACK

Bot token + Files API v2 (v2.0.1 migration)
Multi-channel delivery: slack_channels
Report file upload with scan summary
Scopes: files:write, files:read

TELEGRAM

Bot token + channel ID
Report file upload with caption
Group chat and channel support
Configurable caption per host

DISCORD

Webhook URL integration
Rich embed format with threat detail
Color-coded per threat type
No bot account required
Shared alert_lib.sh v1.0.5 — channel registry · template engine · MIME builder · curl-based delivery · consumed by both LMD and BFD
R rfxn

lmd 2.x · alert reports

Professional HTML scan reports with threat context.

maldet alert from web01.example.com 2026-03-25 14:32:15
247 files scanned 3 threats detected 2 cleaned
{HEX} php.webshell.c99 — /home/user/public_html/shell.php
{YARA} js.skimmer.magecart — /home/store/checkout.js
{MD5} php.backdoor.filesman — /home/user/fm.php → quarantined
LMD 2.0.1 · sigs 2026032483143 · engine ClamAV+YARA+native · scan time 28s

Digest mode: periodic summaries for inotify monitoring · customizable templates in alert/custom.d/

R rfxn
STRUCTURED EVENT LOGGING & SIEM INTEGRATION elog_lib.sh · every event, every format, every destination EVENT BUS elog_event() CLASSIC LOG /var/log/maldet/maldet.log timestamp | severity | message JSON LOG structured key-value machine-parseable CEF ArcSight / QRadar / Splunk CEF:0|R-fx Networks|LMD|2.0.1|... SYSLOG UDP RFC 5424 / RFC 3164 facility + severity + payload GELF Graylog Extended Log Format UDP or HTTP transport ELK Elasticsearch ingest ECS-aligned JSON configurable index AUDIT LOG (JSONL) every scan, quarantine, update, alert — tamper-evident Session TSV: #LMD:v1 header + 19-field metadata + per-hit records
R rfxn

lmd 2.x · siem configuration

Zero-code SIEM integration. Config variables only.

CEF ArcSight / QRadar / Splunk
ELOG_CEF_VENDOR
ELOG_CEF_PRODUCT
ELOG_CEF_VERSION
ELOG_CEF_FILE
SYSLOG UDP RFC 5424 / 3164
ELOG_SYSLOG_UDP_HOST
ELOG_SYSLOG_UDP_PORT
ELOG_SYSLOG_UDP_FACILITY
ELOG_SYSLOG_UDP_FORMAT (5424/3164)
ELOG_SYSLOG_UDP_PAYLOAD (classic/json/cef)
GELF Graylog
ELOG_GELF_HOST
ELOG_GELF_PORT
ELOG_GELF_TRANSPORT (udp/http)
ELOG_GELF_FILE (debug capture)
ELK Elasticsearch / ECS-aligned
ELOG_ELK_URL
ELOG_ELK_INDEX
ELOG_ELK_FILE (debug capture)
AUDIT LOG — ELOG_AUDIT_FILE — always JSONL, always on, tamper-evident

Log rotation built-in · max-lines truncation · logrotate.d integration · elog_lib.sh v1.0.4

R rfxn
lmd 2.x · audit trail

Machine-readable session data for compliance and forensics.

Session header

#LMD:v1 | scanid | hostname | scan_start | scan_end | tot_files | tot_hits | engine | ...

Hit record

sig_name | filepath | quarpath | hit_type | hit_label | hash | size | owner | ...

Hit types: MD5 · SHA256 · HEX · YARA · CAV · CSIG · SA

19 metadata fields
11 hit record fields
21d retention default
R rfxn
R-fx Networks · open source · GPL v2 · since 2002

sigforge + LMD 2.x

Signature intelligence.
Endpoint detection.
Audit-ready logging.

rfxn.com · github.com/rfxn · proj@rfxn.com

R rfxn
1 / 22