# malware-watch installer

`malware-watch` combines process/network behavior detection, abuse.ch ThreatFox/MalwareBazaar IOC feeds, confirmed-threat automatic quarantine, persistent IOC firewall blocking, and optional ClamAV scanning.

## Files

- `install.sh` — installs malware-watch, abuse.ch feed updater, automatic quarantine, IOC firewall restore, systemd timers, and optional official ClamAV.
- `verify.sh` — verifies that the installation is healthy.
- `.env` — installer configuration. **Replace the placeholder values locally before installation.**

The repository version of `.env` contains placeholders only. Never commit a real Discord webhook or abuse.ch Auth-Key.

## Install

```bash
git clone https://github.com/javara999/malware-watch.git
cd malware-watch
chmod +x install.sh verify.sh
nano .env
sudo ./install.sh
```

Required `.env` values:

```bash
DISCORD_WEBHOOK='디스코드웹훅URL'
ABUSECH_AUTH_KEY='abuse.ch api 키'
```

Replace both placeholder strings with your real values only on the server where you are installing.

The installer is safe to rerun after a partial/failed installation. Existing malware-watch files are backed up under `/root/security-evidence/malware-watch/install-backup-*` before replacement.

## Verify installation

```bash
sudo ./verify.sh
```

It checks required files/permissions, malware-watch and abuse.ch timers, ThreatFox/MalwareBazaar feeds, ClamAV installation/account/signature DB/timers, and a real one-shot execution of `malware-watch.py`.

A healthy installation ends with:

```text
Summary: PASS=<number> WARN=0 FAIL=0
```

A `WARN` for the ClamAV signature DB immediately after installation can be normal: `freshclam` may still be waiting for its first successful download. `FAIL` means something should be fixed.

To also send a harmless Discord verification message:

```bash
sudo ./verify.sh --test-discord
```

## Manual status checks

```bash
systemctl status malware-watch.timer --no-pager
systemctl status malware-feed-update.timer --no-pager
systemctl status clamav-freshclam-local.timer --no-pager
systemctl status clamav-risk-scan.timer --no-pager
systemctl status clamav-deep-scan.timer --no-pager
systemctl list-timers --all --no-pager | grep -E 'malware-watch|malware-feed-update|clamav-'
```

Useful logs:

```bash
journalctl -u malware-watch.service -n 100 --no-pager
journalctl -u malware-feed-update.service -n 100 --no-pager
journalctl -u clamav-risk-scan.service -n 100 --no-pager
journalctl -u clamav-deep-scan.service -n 100 --no-pager
journalctl -u clamav-freshclam-local.service -n 100 --no-pager
```

## Security notes

- Confirmed threats are quarantined; ordinary heuristic/high-score findings are not automatically deleted.
- Quarantine/evidence is stored under `/root/security-evidence/`.
- `.env` should be mode `600` on an installed server.
- Keep real webhook/API credentials out of Git history.