Sanesecurity ClamAV: Phishing, Spam & Malware Signatures https://sanesecurity.com/ mad about email, sane about security Thu, 21 Apr 2022 14:40:25 +0000 en-US hourly 1 https://wordpress.org/?v=6.9.4 Improve ClamAV detection rate up to 90% by adding Sanesecurity signatures https://sanesecurity.com/improve-the-detection-rate-up-to-90-of-clamav-antivirus-by-adding-sanesecurity-clamav-signatures/ https://sanesecurity.com/improve-the-detection-rate-up-to-90-of-clamav-antivirus-by-adding-sanesecurity-clamav-signatures/#respond Thu, 31 Dec 2015 18:06:44 +0000 http://sanesecurity.com/?p=765 Sanesecurity ClamAV signatures improve ClamAV detection rate on Macro malware, Javascript malware, Phishing, Spam and other emailed Ransomware.

The post Improve ClamAV detection rate up to 90% by adding Sanesecurity signatures appeared first on Sanesecurity ClamAV: Phishing, Spam & Malware Signatures.

]]> Sanesecurity ClamAV signatures improve ClamAV detection rate on Macro malware, Javascript malware, Phishing, Spam and other emailed Ransomware.

The post Improve ClamAV detection rate up to 90% by adding Sanesecurity signatures appeared first on Sanesecurity ClamAV: Phishing, Spam & Malware Signatures.

]]> https://sanesecurity.com/improve-the-detection-rate-up-to-90-of-clamav-antivirus-by-adding-sanesecurity-clamav-signatures/feed/ 0 Foxhole databases https://sanesecurity.com/foxhole-databases/ Tue, 16 Apr 2013 12:28:27 +0000 http://sanesecurity.com/?p=540 Zero hour (0hr) emailed malware has always been an issue. There are various ways of blocking dangerous attachments within zip files, such as Mailscanner/SpamAssassin/Postfix, however ClamAV can also be used to block these attachments which in some environments may be useful. Foxhole databases use the .cdb extension which uses the ClamAV engine to look inside …

Continue reading

The post Foxhole databases appeared first on Sanesecurity ClamAV: Phishing, Spam & Malware Signatures.

]]> Zero hour (0hr) emailed malware has always been an issue. There are various ways of blocking dangerous attachments within zip files, such as Mailscanner/SpamAssassin/Postfix, however ClamAV can also be used to block these attachments which in some environments may be useful.

Foxhole databases use the .cdb extension which uses the ClamAV engine to look inside certain container/archive files for various filenames/extensions and perform Regular Expressions, on those filenames/extensions.   The foxhole databases also use an .ndb
database for other archives types not covered by a cdb database.

[important]SaneSecurity signatures are a culmination of hard work and commitment to provide Third-Party signatures to the web community that are of professional quality. We are not a company… and producing the signatures and support for the signatures, are carried out in our spare time and at our own cost.
Please consider making a donation[/important]

 

The current foxhole databases are:

 

foxhole_generic.cdb (low false positive risk)

This database will block double extensions of certain dangerous filetypes that are contained within Zip, Rar, 7Zip, Arj and Cab files. These files will be detected only if they end in dangerous filestypes such as: pif, scr, exe, com, bat, cmd, vbs, lnk, cpl and vb.

foxhole_filename.cdb (low false positive risk)

This database will block certain commonly known malware filenames within Zip, Rar, 7z, Arj and Cab archives.

foxhole_js.cdb (medium false positive risk)

This database will block most JavaScript (.js) files within Zip, Rar archived.  The current #locky #javascript #malware is using rapidly changing JavaScript files and this database is aimed at blocking these.  To help minimise false positives, this database will only scan small sized Zip and Rar files.

foxhole_js.ndb (medium false positive risk)
This database will block ALL JavaScript (.js) files within GZip and Ace archives.
The current #locky #javascript #malware is using rapidly changing JavaScript files and this database is aimed at blocking these.

foxhole_all.cdb (high false positive risk)

This database will block all files (single and double extensions) within Zip, Rar and 7z archives that contain dangerous filestypes such as: ade, adp, bat, chm, cmd, com, cpl, exe, hta, ins, isp, jse, lib, mde, msd, msp, mst, pif, scr, sct, shb, sys, vb, vbe, vbs, vxd, wsc, wsf and wsh. This will be the most effective database, combined with foxhole_js.ndb but also has the highest risk of false positives, unless you are using scoring.

foxhole_all.ndb (high false positive risk)

This database will block all files (single and double extensions) within GZip and Ace archives that contain dangerous filestypes such as: ade, adp, bat, chm, cmd, com, cpl, exe, hta, ins, isp, jse, lib, mde, msd, msp, mst, pif, scr, sct, shb, sys, vb, vbe, vbs, vxd, wsc, wsf and wsh. This will be the most effective database, combined with foxhole_js.ndb but also has the highest risk of false positives, unless you are using scoring.

foxhole_mail.cdb (high false positive risk)

This database will block any mail that contain a possible dangerous attachments such as: js, jse, exe, bat, com, scr, uue, ace, pif, jar, gz, lnk, lzh. This will be the most effective database, combined with foxhole_js.ndb but also has the highest risk of false positives, unless you are using scoring.

 

Currently only Zip, Rar, 7z and Arj archives are used, however this can be extended to Cab and Tar files. Please Contact me if that would prove to be useful.

[notice] If you are trying to block large attachments, you may need to increase the value of MaxZipTypeRcg in clamd.conf, from 1M to 3M[/notice]

Example signature names

Sanesecurity.Foxhole.Zip_doc: blocks dangerous double extension .doc files,
within a Zip file.

Sanesecurity.Foxhole.Rar_xls: blocks dangerous double extension .xls files,
within a Rar file

Sanesecurity.Foxhole.Zip_hidden: blocks dangerous double extension files that are trying
to hide their true extension, within a zip file.
Excluding/Whitelisting

If you wish to whitelist one of the above signatures, you can do this by creating your own foxhole.ign2 file and place it in the ClamAV database folder:

[notice]Tech. Note: with .cdb files .UNOFFICIAL has to be added to the signature name (unlike .ndb/.hdb formats)[/notice]

 

Example 1:

printf “Sanesecurity.Foxhole.7z_avi.UNOFFICIAL” > foxhole.ign2

Restart clamd and the Sanesecurity.Foxhole.7z_avi signature will be ignored.

 

Example 2:

printf “Sanesecurity.Foxhole.Zip_lib.UNOFFICIAL” > foxhole.ign2

Restart clamd and the Sanesecurity.Foxhole.Zip_lib signature will be ignored.

[notice] TIP: This may be useful for people who want to use foxhole_all.cdb to block all dangerous attachments within archives, however want to make an exception for .lib files, by whitelisting it.[/notice]

The post Foxhole databases appeared first on Sanesecurity ClamAV: Phishing, Spam & Malware Signatures.

]]> Sanesecurity: improve ClamAV detection rate https://sanesecurity.com/sanesecurity-who/ Thu, 05 Jan 2012 10:51:17 +0000 http://www.sanesecurity.me.uk/wordpress/?p=115 Since 2006, SaneSecurity have provide hourly updated ClamAV signatures to the web community that are of professional quality and help improve ClamAV detection rate, especially on word/Excel Macro malware and other Zip/Rar/7z/Gzip archive malware.

The post Sanesecurity: improve ClamAV detection rate appeared first on Sanesecurity ClamAV: Phishing, Spam & Malware Signatures.

]]> Since 2006, SaneSecurity have provide hourly updated ClamAV signatures to the web community that are of professional quality and help improve ClamAV detection rate,
especially on word/Excel Macro malware and other Zip/Rar/7z/Gzip archive malware.

The post Sanesecurity: improve ClamAV detection rate appeared first on Sanesecurity ClamAV: Phishing, Spam & Malware Signatures.

]]> Other Third Party ClamAV signatures https://sanesecurity.com/more-features/ Thu, 05 Jan 2012 09:51:11 +0000 http://www.sanesecurity.me.uk/wordpress/?p=84 Sanesecurity also distribute other Third Party signatures. All these signatures combined help improve ClamAV detection rate and help keep you malware free.

The post Other Third Party ClamAV signatures appeared first on Sanesecurity ClamAV: Phishing, Spam & Malware Signatures.

]]> Sanesecurity also distribute other Third Party signatures. All these signatures combined help improve ClamAV detection rate and help keep you malware free.

The post Other Third Party ClamAV signatures appeared first on Sanesecurity ClamAV: Phishing, Spam & Malware Signatures.

]]> Macro malware, Zip/Rar/7z malware, Javascript malware: we block them https://sanesecurity.com/66/ Wed, 04 Jan 2012 16:30:22 +0000 http://www.sanesecurity.me.uk/wordpress/?p=66 Sanesecurity add-on signatures provide enhanced email security against the following email types: Macro malware, Phishing, Zip malware, Rar malware, 7z malware, Javascript malware, Spear phishing, Fake lottery, fake dating scams,  and other general spams.

The post Macro malware, Zip/Rar/7z malware, Javascript malware: we block them appeared first on Sanesecurity ClamAV: Phishing, Spam & Malware Signatures.

]]> Sanesecurity add-on signatures provide enhanced email security against the following email types:

Macro malware, Phishing, Zip malware, Rar malware, 7z malware, Javascript malware, Spear phishing, Fake lottery, fake dating scams,  and other general spams.

The post Macro malware, Zip/Rar/7z malware, Javascript malware: we block them appeared first on Sanesecurity ClamAV: Phishing, Spam & Malware Signatures.

]]>