S3 Malware Scanning
Scan S3-compatible buckets for malware using ClamAV and the pure-Rust yara-x engine.
- Every scan runs ClamAV (INSTREAM protocol) and yara-x in parallel against downloaded objects — no C libyara dependency.
- Positive or ambiguous findings are enriched with VirusTotal and AlienVault OTX threat-intelligence lookups before results are stored.
- Bucket credentials use a hybrid model: assume_role for real AWS buckets (short-lived STS credentials, no stored secret) or envelope-encrypted static credentials for S3-compatible endpoints with no STS support (MinIO, Wasabi).
- Findings are hashed (SHA-1/SHA-2) and file-typed by magic bytes so they can be cross-referenced against external threat feeds.