ClamAV & YARA — Function and Command Reference

Installation

Packages from the Ubuntu/Zorin repo. clamav-daemon provides background scanning; clamtk is a GUI.

Install ClamAV + YARA + GUIapt

sudo apt update
sudo apt install clamav clamav-daemon clamtk yara -y

Packages: clamav (clamscan/freshclam), clamav-daemon (clamd/clamdscan), clamtk (GUI), yara (standalone engine).

freshclam

update

Fetches and updates virus definitions (main.cvd, daily.cvd, bytecode.cvd). Normally runs as a background service.

Manual update

# Stop the service first — otherwise it locks the database
sudo systemctl stop clamav-freshclam
sudo freshclam
sudo systemctl start clamav-freshclam

Flag	Funktion
`-v`	Verbose output during download
`--daemon` / `-d`	Run as a background daemon with periodic checks
`--checks=N` / `-c N`	Number of database checks per day (daemon mode)
`--datadir=PATH`	Path to the database directory (default `/var/lib/clamav`)
`--config-file=PATH`	Use an alternative `freshclam.conf`
`--show-progress`	Show a progress bar during download
`--on-update-execute=CMD`	Run a command after a successful update
`--list-mirrors`	Show the status of known mirrors

clamscan

on-demand scanner

Standalone scanner. Loads the entire signature database into RAM on every run — thorough, but slow. Use clamdscan for frequent scanning.

Scan a folder, show finds only

clamscan -ri ~/Downloads

-r recursive · -i infected only

Scan with a beep on a find

clamscan -ri --bell ~

Move finds to quarantine

mkdir -p ~/quarantine
clamscan -ri --move=~/quarantine ~

Prefer --move over --remove

Scan the entire system

sudo clamscan -ri / --exclude-dir="^/sys|^/proc"

Flag	Funktion
`-r` / `--recursive`	Scan subdirectories recursively
`-i` / `--infected`	Show infected files only
`-o`	Suppress OK results (errors/finds only)
`--bell`	Audible signal on a find
`--remove[=yes/no]`	Delete infected files (destructive — be careful)
`--move=DIR`	Move finds to a quarantine folder
`--copy=DIR`	Copy finds to a folder (keep the original)
`-l FILE` / `--log=FILE`	Write the scan result to a log file
`-d FILE/DIR` / `--database=`	Use a custom signature database or YARA rule
`--exclude=REGEX`	Skip files by regex on the path
`--exclude-dir=REGEX`	Skip directories by regex
`--include=REGEX`	Scan matching files only
`--max-filesize=N`	Skip files larger than N (e.g. 100M)
`--max-scansize=N`	Max data scanned per file
`--max-recursion=N`	Max depth in archive/compression layers
`--scan-archive[=yes/no]`	Scan inside zip/rar/tar etc. (default yes)
`--detect-pua[=yes]`	Detect Potentially Unwanted Applications
`--scan-pe / --scan-elf / --scan-ole2`	Toggle scanning of specific file types on/off
`--alert-encrypted[=yes]`	Flag encrypted archives/documents as suspicious
`--alert-broken[=yes]`	Flag broken executable files
`--alert-macros[=yes]`	Warn about macros in Office documents
`--bytecode[=yes]`	Enable bytecode signatures (advanced detection)
`--gen-json`	Generate JSON metadata about scanned objects
`-z` / `--allmatch`	Continue scanning a file after the first match
`--stdout`	Send all output to stdout (including errors)
`-V` / `--version`	Show version + database info

Exit codes: 0 = no finds · 1 = malware found · 2 = error. Useful in scripts: clamscan -ri ~ || echo "found!"

clamdscan

daemon client

Sends scan jobs to the running clamd daemon, which already has the database in memory. Markedly faster for repeated scans.

Fast scan via the daemon

clamdscan -r ~/Downloads

Multithreaded file passing

clamdscan --multiscan --fdpass ~

Flag	Funktion
`-m` / `--multiscan`	Scan in parallel with multiple threads
`--fdpass`	Pass the file descriptor to the daemon (works around permission issues)
`--stream`	Stream file content to the daemon over the socket
`-i` / `--infected`	Show finds only
`--move=DIR` / `--remove`	Quarantine / deletion as in clamscan
`--config-file=PATH`	Alternative `clamd.conf`
`-l FILE`	Log file

clamd & service

daemon

The background daemon that keeps the database in RAM and offers on-access scanning (real-time monitoring of the file system via fanotify).

Enable & start the daemon

sudo systemctl enable --now clamav-daemon

On-access (real-time) scan

# requires OnAccess* in clamd.conf
sudo clamonacc -v

clamd.conf option	Funktion
`OnAccessIncludePath`	Directory monitored in real time
`OnAccessPrevention`	Block access to infected files (not just alert)
`OnAccessExtraScanning`	Also scan on create/move events
`MaxThreads`	Number of scan threads in the daemon
`LocalSocket`	Unix socket path for client communication
`LogFile` / `LogTime`	Log destination and timestamping

clamconf dumps the entire active configuration for troubleshooting: clamconf -n

sigtool

signatures

A tool to inspect databases and build your own signatures — useful when you create custom detection in DFIR cases.

Command	Function
`sigtool --info FILE.cvd`	Show metadata about a database file (version, signature count)
`sigtool --unpack FILE.cvd`	Unpack the database into raw signature files
`sigtool --md5 FILE`	Generate an MD5 hash signature of a file
`sigtool --sha256 FILE`	Generate a SHA256 hash signature
`sigtool --hex-dump`	Convert input to hex for use in signatures
`sigtool --find-sigs=REGEX`	Find signatures matching a pattern in the database
`sigtool --vba FILE`	Extract VBA macros from Office documents

Custom hash signature: sigtool --sha256 malware.bin > min.hsb → place .hsb in /var/lib/clamav/ and scan with clamscan -d min.hsb

yara

detection rules

Pattern-based classification of files and processes from rules you write yourself. Standalone YARA supports all modules (pe, elf, hash, math, cuckoo and more) — unlike ClamAV's built-in YARA support.

Run a rule against a folder

yara -r rules.yar ~/case

Show matching strings

yara -r -s rules.yar ~/case

Compile rules (faster)

yarac rules.yar rules.cmp
yara -r rules.cmp ~/case

Scan a running process

sudo yara rules.yar $(pidof suspect_process)

YARA can scan PIDs directly — powerful for memory forensics

Ready-made rule sets: Neo23x0/signature-base (Florian Roth, motoren bag LOKI/THOR), Elastic protections-artifacts, Yara-Rules/rules. Clone and run recursively: yara -r signature-base/yara/ ~/case 2>/dev/null

YARA flag-reference

Complete flag overview for yara CLI.

Flag	Funktion
`-r` / `--recursive`	Scan directories recursively
`-s` / `--print-strings`	Show the strings that matched
`-m` / `--print-meta`	Show metadata from the rule (author, ref, desc)
`-g` / `--print-tags`	Show rule tags
`-e` / `--print-namespace`	Show the namespace for a matched rule
`-L` / `--print-stats`	Show statistics after scanning
`-c` / `--count`	Show only the number of matches per rule
`-d VAR=VALUE`	Define an external variable for the rule
`-t TAG` / `--tag=TAG`	Show only rules with this tag
`-i ID` / `--identifier=`	Run only the rule with this name
`-n` / `--negate`	Show files that do not match
`-w` / `--no-warnings`	Suppress warnings
`-f` / `--fast-scan`	Fast scan (stop at the first match per string)
`-x MODULE=FILE`	Pass module data (e.g. cuckoo report) to the rule
`-p N` / `--threads=N`	Number of threads for parallel scanning
`-a N` / `--timeout=N`	Abort scanning after N seconds
`-z N` / `--max-strings-per-rule`	Cap on strings per rule
`--max-process-memory-chunk`	Chunk size for process scanning
`-X N` / `--skip-larger=N`	Skip files larger than N bytes
`--scan-list`	Treat the input as a file with a list of paths
`-v` / `--version`	Show the YARA version

Anatomy of a rule: rule name { meta: … strings: $a = "x" condition: $a } — the sections meta, strings and condition. Modules are imported at the top with import "pe".

YARA in ClamAV

integration

ClamAV can load YARA rules natively alongside its own signatures.

Place YARA rules in ClamAV's database

sudo cp rules.yar /var/lib/clamav/
# or scan ad hoc with -d:
clamscan -r -d rules.yar ~/case

Limitations: ClamAV's YARA engine does not support all features. Modules such as pe, hash, math and external variables don't work, and rules using them are rejected on load. For full functionality — including signature-base — use standalone YARA.

Automation

systemd / cron

Schedule weekly scanning and logging.

Weekly cron scan with logging

# crontab -e  → run every Sunday at 02:00
0 2 * * 0 clamdscan -r --fdpass /home \
  -l /var/log/clamav/weekly-$(date +\%F).log -i

Combined ClamAV + YARA wrapper

#!/usr/bin/env bash
TARGET="${1:-$HOME}"
TS=$(date +%F_%H%M)
clamdscan -r --fdpass -i "$TARGET" | tee "clam_$TS.log"
yara -r -m ~/yara/signature-base/yara/ "$TARGET" \
  2>/dev/null | tee "yara_$TS.log"