linux-malware-detect

linux-malware-detect copied to clipboard

[Feature Request] Use custom yara rules

1

maldet should be able to use yara rules. Yes we can use clamav for that. But using clamav with maldet sometimes there's a bug not found any malware when scanning.

erikdemarco

Overriding internals variables via `conf.maldet.cron` isn't working on CentOS 7. Doing some testing, I found that the issue arises from using both `source` and `.` in the cron.daily file. Changing...

zombrie

maldet will never send slack notifications in monitor mode.

1

If we are running in monitor mode, then the daily crontab will simply call 'maldet --monitor-report', this calls genalert in digest mode instead of file mode. The scan function calls...

zelch

In my testing sometimes the malware name seems to missing from the /usr/local/maldetect/sess/quarantine.hist randomly. To replicate: Download the sample malware collection from below into a web directory and run a...

Gazoo

Service doesn't start in debian testing

1

There is a problem in internals/functions file. In the line 1660, there is an if that looks for inotify_ in /boot/System.map-$(uname -r) In Debian this file only contain the following...

kesnol

Maldet monitoring daemon causes ClamAV to think that signatures have changed forcing them to be constantly reloaded

1

When the maldet daemon is running the ClamAV daemon always thinks that signature databases have changed (according to the SelfCheck interval) and forces a reload of signatures (even though signatures...

Gazoo

I got error during installation: update-rc.d: error: unable to read /etc/init.d/maldet

erikdemarco

Is this project still alive and some bugs

3

Hello, I'm using version **1.6.4**, **OS Debian 10**, and when I try this after scan (maldet -a /): **maldet -s id** I get output with a lot of those: `cat:...

ZEROF

LMD detects malware in own directory

1

That's weird: Ran a full system scan, and LMD reports 2 hits, both in LMD's directory. "LMD's directory" is the place where I extracted the archive and ran the install...

tapulator

rfxn.yara clamav error and a false positive on openssl tls1.h

4

Seems latest rfxn database identifies `openssl-1.1.1c/include/openssl/tls1.h` as `YARA.php_malware_hexinject.UNOFFICIAL`. To replicate: ```sh mkdir /tmp/scan cd /tmp/scan wget https://anaconda.org/conda-forge/openssl/1.1.1c/download/linux-64/openssl-1.1.1c-h516909a_0.tar.bz2 tar xf openssl-1.1.1c-h516909a_0.tar.bz2 rm -f /var/lib/clamav/rfxn.* ``` Plain clamscan without rfxn db: ```sh...

odlevakp