# rfxn/linux-malware-detect

Multi-engine Linux malware scanner with five detection stages (MD5, HEX pattern, YARA, ClamAV, statistical), real-time inotify monitoring, quarantine, and multi-channel alerting

Repository: https://github.com/rfxn/linux-malware-detect
Canonical: https://ross.abutalabs.com/products/linux-malware-detect
Homepage: http://www.rfxn.com/projects/linux-malware-detect/
Language: Shell
License: GPL-2.0
License Family: copyleft
Topics: bash, clamav, inotify, intrusion-detection, linux-security, malware-detection, security-scanner, yara
Last push: 2026-05-24T19:55:24+00:00

## Health v2 (maintenance only)
Score: 86/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 84, release rhythm 81, longevity 100
- inputs: {"age_days": 4742, "days_push": 101, "days_rel": 126, "gap_med": 2, "n_releases_24m": 4}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1490, forks 247 (observed 2026-08-28T04:04:52.412663+00:00)

## What it is
Linux Malware Detect (LMD) is a bash-based malware scanner for Linux servers featuring a multi-stage detection pipeline (MD5/SHA-256 hashing, HEX pattern matching, YARA rules, and statistical analysis) with ClamAV integration. It provides real-time inotify file monitoring, quarantine/clean/restore operations, and multi-channel alerting via email, Slack, Discord, and Telegram.

## Use cases
- scan a linux server for malware and web shells
- detect injected backdoors on a shared hosting server
- monitor directories in real time for malicious file changes
- scan uploaded files with modsecurity inspectfile hook
- export custom malware signatures to clamav
- quarantine and clean infected files automatically
- get slack or telegram alerts when malware is found

## When to choose
- you run linux servers, especially shared hosting, and need a lightweight pure-bash malware scanner
- you want real-time inotify monitoring plus multi-engine detection without heavy agents
- you need quarantine, alerting, and ClamAV signature export in one tool

## When to avoid
- you need endpoint protection on non-Linux platforms
- you require a GUI-managed enterprise EDR with centralized fleet management
- you need real-time process/memory forensics rather than file scanning

## Facets
- artifact type: cli-tool
- maturity: active
- function: security, monitoring, alerting, cli
- domain: security, operating-systems, self-hosted
- platform: cli
- tags: malware-scanner, clamav, yara, inotify, quarantine, bash, shared-hosting, webshell-detection, malware-detection, web-hosting, linux

## Member repositories
- rfxn/linux-malware-detect (main) score 86

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:52.412663+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T04:33:37.966842+00:00, confidence not recorded.
  - readme: https://github.com/rfxn/linux-malware-detect (fetched 2026-08-28T04:04:52.412663+00:00, sha 1c32c6b2786c)
  - homepage: http://www.rfxn.com/projects/linux-malware-detect/ (fetched 2026-08-29T11:39:35.103737+00:00, sha 6f59f0dd78ca)
  - site_page: http://www.rfxn.com/docs (fetched 2026-08-29T11:39:35.106371+00:00, sha 8e9948581a2d)
  - site_page: http://www.rfxn.com/docs/linux-malware-detect (fetched 2026-08-29T11:39:35.108269+00:00, sha a04e394f3c80)
  - site_page: http://www.rfxn.com/about (fetched 2026-08-29T11:39:35.113504+00:00, sha 807be566f22b)
  - site_page: http://www.rfxn.com/changelog (fetched 2026-08-29T11:39:35.111236+00:00, sha b46fb453e9b0)
- Data as of 2026-08-30T08:39:29.467469+00:00.