Malware Scan Configuration

Malware scanning can be configured using either command line arguments, the INI file, or a combination of both.

Command Line Arguments

• --read-stdin: Read paths from stdin. If not specified, paths will automatically be read from stdin when input is not from a TTY.
• -s, --file-list-separator: Separator used when listing files via stdin. Defaults to the null byte.
• --output: Write results to stdout. This is the default behavior when --output-path is not specified.
• --output-path: Path to which to write results.
• --output-columns: An ordered, comma-delimited list of columns to include in the output. Available columns: filename, signature_id, signature_name, signature_description, matched_text. Compatible formats: csv, tsv, null-delimited, line-delimited, human.
• -m, --output-format: Output format used for result data.
• --output-headers: Include column headers in output. Compatible formats: csv, tsv, null-delimited, line-delimited.
• -e, --exclude-signatures: Specify rule IDs to exclude from the scan. Can be comma-delimited and/or specified multiple times.
• -i, --include-signatures: Specify rule IDs to include in the scan. Can be comma-delimited and/or specified multiple times.
• --images: Include image files in the scan.
• -a, --include-all-files: Scan all files. By default, only files matching certain extensions are scanned
• -n, --include-files: Only scan filenames that are exact matches. Can be used multiple times.
• -x, --exclude-files: Do not scan filenames that are exact matches. Can be used multiple times. Denials take precedence over allows.
• -N, --include-files-pattern: Python regex allow pattern. Only matching filenames will be scanned.
• -X, --exclude-files-pattern: Python regex deny pattern. Matching filenames will not be scanned.
• --allow-io-errors: Allow scanning to continue if IO errors are encountered. Files that cannot be read will be skipped and a warning will be logged.
• -z, --chunk-size: Size of file chunks that will be scanned. Use a whole number followed by one of the following suffixes: b (byte), k (kibibyte), m (mebibyte). Defaults to 3m.
• -M, --scanned-content-limit: The maximum amount of data to scan in each file. Content beyond this limit will not be scanned. Defaults to 50 mebibytes. Use a whole number followed by one of the following suffixes: b (byte), k (kibibyte), m (mebibyte).
• --match-engine: The regex engine to use for malware scanning. Options: pcre, vectorscan (default: pcre)
• --match-all: If set, all possible signatures will be checked against each scanned file. Otherwise, only the first matching signature will be reported
• --pcre-backtrack-limit: The regex backtracking limit for signature evaluation
• --pcre-recursion-limit: The regex recursion limit for signature evaluation
• -w, --workers: Number of worker processes used to perform scanning. Defaults to 1 worker process.
• --progress: Display scan progress in the terminal with a curses interface

INI Options

[MALWARE_SCAN]
# Read file paths to scan from stdin
read_stdin = [on|off]
file_list_separator = <separator string, defaults to null byte>
# Controls whether or not output is written to stdout
output = [on|off]
output_path = <path to which to write results>
# Comma-delimited list of columns to include in output (`filename`, `signature_id`, `signature_name`, `signature_description`, `matched_text`)
output_columns = <columns>
output_format = [human|csv|tsv|null-delimited|line-delimited]
# Whether to include headers in output
output_headers = [on|off]
# Comma-delimited list of signature IDs
exclude_signatures = <signatures>
include_signatures = <signatures>
images = [on|off]
include_all_files = [on|off]
# Comma-delimited list of filenames
include_files = <filenames>
exclude_files = <filenames>
# Comma-delimited list of Python regex patterns
include_files_pattern = <patterns>
exclude_files_pattern = <patterns>
allow_io_errors = [on|off]
# Files are scanned in chunks of this size, may use b, k, or m suffix
chunk_size = <size>
# Maximum amount of data to scan for each file, may use b, k, or m suffix
scanned_content_limit = <size>
match_engine = [pcre|vectorscan]
match_all = [on|off]
# Backtrack limit option for PCRE, should be an integer
pcre_backtrack_limit = <limits>
# Number of workers to use
workers = <number>
# Alternate database path when using vectorscan
pattern_database_path = <path>
# Whether or not to compile the vectorscan database locally
compile_local = [on|off]
# Toggle direct IO (avoids filesystem caching)
direct_io = [on|off]