Intrusion Detection & Malware Scanning
Perimeter firewalls alone are not enough if web applications or stolen credentials allow attackers inside. We deploy automated multi-engine scanning that continuously inspects memory, kernel hooks, binary checksums, and filesystems to quarantine threats instantly.
Four Integrated Threat-Hunting Engines
Continuous monitoring across kernel, storage, memory, and package management layers:
Rootkit Hunter & Kernel Heuristics
Deep kernel diagnostic scanning for Loadable Kernel Module (LKM) rootkits, hidden malicious background processes, anomalous /dev nodes, and altered system call tables.
- ✓Daily automated cron execution with quiet reporting
- ✓Kernel module hook and hidden socket diagnostics
- ✓Promiscuous network interface packet sniffing detection
- ✓Baseline signature updates against emerging rootkits
Web Shell & Antivirus Quarantine
High-speed automated scanning of web roots (/var/www), temporary directories (/tmp, /dev/shm), and upload folders for PHP backdoors, crypto-miners, and trojans.
- ✓8.7M+ constantly updated virus and web shell signatures
- ✓Automated quarantine isolation to /var/quarantine/
- ✓Detection of obfuscated eval(base64_decode()) payloads
- ✓Instant email notifications on positive threat detection
Real-Time Kernel File Integrity Monitor
Immutable kernel-level audit trail monitoring unauthorized access or modification of authentication files (/etc/passwd, /etc/shadow, /etc/sudoers, /etc/ssh).
- ✓Non-bypassable kernel syscall monitoring
- ✓Tracking of privilege escalation and execution of sudo/su
- ✓Real-time alerts on tampering with system cron schedules
- ✓Tamper-resistant audit logs conforming to CIS requirements
Binary Cryptographic Integrity
Validates all core operating system binaries (/bin/ls, /bin/ps, /usr/sbin/sshd, /bin/netstat) against official vendor package repository cryptographic hashes.
- ✓Detection of trojanized or replaced core utilities
- ✓Automated nightly verification of 100,000+ files
- ✓Immediate alert if any system binary hash mismatches
- ✓Zero performance impact on production traffic
Live Threat Detection & Isolation Logs
Step through real scan outputs generated by our automated security scripts:
Live Scanning Engine & Quarantine Simulation
----------- SCAN SUMMARY ----------- Known viruses: 8,742,910 Engine version: 0.103.11 Scanned directories: 4,821 Scanned files: 42,918 Infected files: 1 [DETECTED]: /var/www/vhosts/app/uploads/2024/08/cache_thumb.php: Php.Malware.Wso-7981 FOUND [ACTION]: Automatically isolated -> /var/quarantine/20240825_cache_thumb.php.quarantine [SECURED] [NOTIFY]: Alert dispatched to info@khodshimasumnassistltd.com and admin webhook Time: 24.182 sec (0 m 24 s)
Choose Your Threat Detection Plan
Deploy standalone threat-hunting scripts or turnkey setup with active monitoring:
Complete suite of configured rkhunter, ClamAV, and auditd playbooks with scheduled cron jobs and documentation.
- ✓Configured RKHunter & ClamAV daemon playbooks
- ✓CIS-compliant Auditd rule configuration files
- ✓Automated nightly scan & quarantine scripts
- ✓Email alert notification hooks
- ✓14-day technical support
Khodshima engineers deploy, tune, and test all 4 intrusion detection engines directly on your server with email alerts.
- ✓Complete turnkey installation across all 4 engines
- ✓Initial baseline signature generation & dry-run scan
- ✓Quarantine directory setup with safe isolation routines
- ✓Automated email digest & instant incident dispatching
- ✓Fine-tuning to prevent false-positive alarms
- ✓30-day post-installation engineering warranty
Complete package: Full Linux Hardening, NFTables firewall, Web Stack security, plus all 4 intrusion detection engines.
- ✓Full Turnkey Linux Server Hardening & NFTables filter
- ✓Complete 4-engine intrusion detection & malware scanner
- ✓Pre- and post-installation Lynis security audit
- ✓Web stack & database isolation
- ✓60-day engineering warranty & stability guarantee