ClamAV scan

clamscan -r /home

Recursively scans a directory with ClamAV, detecting known malware in Linux system files.

Run it when you need an antivirus scan on a Linux: clamscan traverses the specified directory (-r recursive) and detects known malware by signature — malicious binaries, webshells, scripts — with details of each finding. It's the reference open-source AV for Linux: point-in-time scanning of a suspicious directory (downloads, a user's home, the web directory) and scheduled periodic checks. In IR, clamscan is the known-malware pass on the host: the webshell in /var/www, the binary in /tmp — files that match ClamAV signatures (with updated definitions).

Don't use it as complete detection: ClamAV detects by signature — new, obfuscated, or custom malware won't match; and ClamAV signatures cover common malware (APTs with custom tools won't show up). Outdated definitions (freshclam) make the scan useless: updating is part of the workflow. And watch performance: recursive scanning of large directories (whole disk) takes hours — scope it to the relevant directory or schedule it. In IR, clamscan is one more pass: confirmation of known malware, not a clean verdict. For behavior detection, EDR and monitoring are the layer.