Sentinel is powered by Linux Malware Detect. Linux Malware Detect uses multifaceted threat data from network edge IPS, community data, ClamAV, and user submission systems to extract malware that is actively being used in attacks. The threat landscape in todays hosted environments is unique from that of the standard AV products detection suite in that they are detecting primarily OS level trojans, rootkits and traditional file-infecting viruses but missing the ever increasing variety of malware on the user account level which serves as an attack platform.
# /usr/local/maldetect/maldet --help
Linux Malware Detect v1.6.2
(C) 2002-2017, R-fx Networks <proj@rfxn.com>
(C) 2017, Ryan MacDonald <ryan@rfxn.com>
This program may be freely redistributed under the terms of the GNU GPL v2
signature set: 201806206951
usage /usr/local/sbin/maldet [ OPTION ]
-b, --background
Execute operations in the background, ideal for large scans
e.g: maldet -b -r /home/?/public_html 7
-u, --update-sigs [--force]
Update malware detection signatures from rfxn.com
-d, --update-ver [--force]
Update the installed version from rfxn.com
-f, --file-list
Scan files or paths defined in line spaced file
e.g: maldet -f /root/scan_file_list
-r, --scan-recent PATH DAYS
Scan files created/modified in the last X days (default: 7d, wildcard: ?)
e.g: maldet -r /home/?/public_html 2
-a, --scan-all PATH
Scan all files in path (default: /home, wildcard: ?)
e.g: maldet -a /home/?/public_html
-i, --include-regex REGEX
Include paths/files from file list based on supplied posix-egrep regular
expression.
e.g: To include only paths named wp-content and files ending in .php:
--include-regex ".*/wp-content/.*|.*.php$"
-x, --exclude-regex REGEX
Exclude paths/files from file list based on supplied posix-egrep regular
expression.
e.g: To exclude paths containing 'wp-content/w3tc/' and core files:
--exclude-regex ".*wp-content/w3tc/.*|.*core.[0-9]+$"
-m, --monitor USERS|PATHS|FILE|RELOAD
Run maldet with inotify kernel level file create/modify monitoring
If USERS is specified, monitor user homedirs for UID's > 500
If FILE is specified, paths will be extracted from file, line spaced
If PATHS are specified, must be comma spaced list, NO WILDCARDS!
e.g: maldet --monitor users
e.g: maldet --monitor /root/monitor_paths
e.g: maldet --monitor /home/mike,/home/ashton
-k, --kill-monitor
Terminate inotify monitoring service
-c, --checkout FILE
Upload suspected malware to rfxn.com for review & hashing into signatures
-l, --log
View maldet log file events
-e, --report SCANID email
View scan report of most recent scan or of a specific SCANID and optionally
e-mail the report to a supplied e-mail address
e.g: maldet --report
e.g: maldet --report list
e.g: maldet --report 050910-1534.21135
e.g: maldet --report SCANID user@domain.com
-s, --restore FILE|SCANID
Restore file from quarantine queue to orginal path or restore all items from
a specific SCANID
e.g: maldet --restore /usr/local/maldetect/quarantine/config.php.23754
e.g: maldet --restore 050910-1534.21135
-q, --quarantine SCANID
Quarantine all malware from report SCANID
e.g: maldet --quarantine 050910-1534.21135
-n, --clean SCANID
Try to clean & restore malware hits from report SCANID
e.g: maldet --clean 050910-1534.21135
-U, --user USER
Set execution under specified user, ideal for restoring from user quarantine or
to view user reports.
e.g: maldet --user nobody --report
e.g: maldet --user nobody --restore 050910-1534.21135
-co, --config-option VAR1=VALUE,VAR2=VALUE,VAR3=VALUE
Set or redefine the value of conf.maldet config options
e.g: maldet --config-option email_addr=you@domain.com,quarantine_hits=1
-p, --purge
Clear logs, quarantine queue, session and temporary data.
--web-proxy IP:PORT
Enable use of HTTP/HTTPS proxy for all remote URL calls.
File | Description |
---|---|
/usr/local/maldetect/conf.maldet |
Configuration file for linux malware detect |
/usr/local/maldetect/monitor_paths |
Inotify file monitoring paths |
/usr/local/maldetect/ignore_file_ext |
File extensions to ignore when scanning |
/usr/local/maldetect/ignore_sigs |
Signatures to ignore when scanning |
/usr/local/maldetect/ignore_paths |
Regex paths to ignore when scanning |
/usr/local/maldetect/ignore_inotify |
Regex paths to ignore when using inotify monitoring |