https://rfxn.com/projects/linux-malware-detect
Order-of-magnitude faster shell-native malware scanning for Linux
Linux Malware Detect (LMD) is a high-performance malware scanner for Linux designed around the threats faced in shared hosted environments. v2.0.1 represents a complete architectural overhaul, introducing a batch-parallel scanning engine that delivers order-of-magnitude performance gains over traditional security tools.
The scanner leverages hardware-accelerated SHA-256 (SHA-NI) and Aho-Corasick string matching to identify web shells, injected backdoors, and obfuscated payloads at wire speed. By short-circuiting matches at the hash layer, LMD avoids unnecessary content scanning, providing a massive reduction in I/O and CPU overhead.
By using threat intelligence derived from network edge intrusion detection systems, LMD generates signatures for malware that is actively being used in real-world attacks. These signatures are easily exported to ClamAV, providing a layered defense-in-depth approach for production Linux servers.