Maldet

Maldet, also called Linux Malware Detect, is a malware scanner designed for Linux hosts. It identifies threats by combining signature-based detection, which it updates from its own threat research team, with heuristic rules that catch obfuscated or unknown variants. The tool digs through file paths, compresses archives, and checks memory processes. It integrates with ClamAV to use its signatures as well. LMD can quarantine or delete infected files and send alerts via email. Its configuration file lets you set scan exclusions, action policies, and notification preferences. The project was created by R-fx Networks, and the original developer, Mike Guthrie, maintained it for years. Maldet suits hosting providers and sysadmins who need a lightweight scanner that does not require a database backend. It works with most Linux distributions and installs from a simple setup script. One notable feature is its ability to scan for encoded or packed PHP shells, which are common in compromised shared hosting accounts. The signature set updates daily, and users can manually trigger fresh downloads. For automated defense, you can run it as a cron job. Newer versions also support JSON output for integration with monitoring tools.