<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">ClamAV will check inside archive files
(like .tar), a simple checksum will not.<br>
<br>
I don't know how much traffic you see, but you could always just
extract everything and then scan it with ClamAV, either via cron
or incron. Here's how you enable that:<br>
<br>
<blockquote type="cite"> - file-store:<br>
enabled: yes # set to yes to enable<br>
log-dir: files # directory to store the files<br>
force-magic: no # force logging magic on all stored
files<br>
# force logging of checksums, available hash functions are
md5,<br>
# sha1 and sha256<br>
#force-hash: [md5]<br>
force-filestore: yes # force storing of all files<br>
</blockquote>
<br>
What I would do is make the 'files' a tmpfs partition and then
scan every file older than one minute via a cron job. This is so
you don't scan partially downloaded files. Then have clamAV move
infected files and their associated metadata to a disk archive for
storage. <br>
<br>
-Coop<br>
<br>
On 7/12/2017 5:58 AM, Srinivasreddy R wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAJP4VWgF7gYXOecyLH+sk1uhDvOfhB9Nf5wjrf3mjQY_eZF3Ng@mail.gmail.com">
<div>Hi all,<br>
<br>
I have downloaded clamAV database and converted to md5 hash
database .<br>
</div>
Added rule in suricata to scan md5 hash DB for threats.<br>
<div><br>
i have downloaded a tar file having threat .ClamAV is able to
detect the threat in the tar file but suricata is not
identifying .<br>
</div>
<div>Please suggest .<br>
<div><br>
Ref Link:<br>
<a
href="https://samiux.blogspot.in/2015/10/howto-clamav-for-suricata.html"
moz-do-not-send="true">https://samiux.blogspot.in/2015/10/howto-clamav-for-suricata.html</a><br>
<div class="gmail_extra"><a
href="http://old.honeynet.org/scans/scan19/scan19.tar.gz"
moz-do-not-send="true">http://old.honeynet.org/scans/scan19/scan19.tar.gz</a><br>
<br>
Thanks<br>
</div>
<div class="gmail_extra">srinivas</div>
</div>
</div>
</blockquote>
<p><br>
</p>
<pre class="moz-signature" cols="72">--
Cooper Nelson
Network Security Analyst
UCSD ACT Security Team
<a class="moz-txt-link-abbreviated" href="mailto:cnelson@ucsd.edu">cnelson@ucsd.edu</a> x41042</pre>
</body>
</html>