Hash signatures
MD5, SHA-1 and SHA-256 of known-bad files, computed in a single streaming pass. Exact matches, so zero false positives — but only for that exact build.
Features & tools
Everything Guardiantus does.
The complete list, grouped the way the product is built.
Detection engine
Four independent layers. Any one of them can convict a file.
Pattern signatures
A hex or ASCII fragment that must appear in the file, optionally anchored to a magic value. Survives trivial repacking and covers whole families.
YARA rules
Native yara-python when installed. Without it, a built-in interpreter
handles the bundled rule subset — and skips anything it cannot parse, so a missing
dependency can never invent a false positive.
Heuristics
Scored rules summed against a threshold you control — but an alarm always needs one construct that is specific to malware.
- Encoded commands, eval chains, reverse shells
- Shadow-copy deletion and ransom-note text
- Double extensions like
invoice.pdf.exe - Right-to-left override filenames
- Executables masquerading as documents or media
Entropy, packing, embedded base64 and process-injection API imports only ever corroborate one of the above. On their own they describe a game asset bundle or a launcher log just as well.
Archive inspection
ZIP members are scanned in memory, never unpacked to disk. Flags zip bombs by compression ratio and members that escape the extraction directory.
Bundled content
13 YARA rules covering reverse shells, ransomware, infostealers, keyloggers, process injection, miners, cron persistence and macro droppers — plus a baseline signature set and two harmless self-test files.
Protection & scanning
What runs continuously, and what you trigger.
Real-time protection
- Event-driven via watchdog
- Polling fallback, no dependencies
- Quarantine or report-only
- Per-folder watch list
- Skips half-written downloads
Scan types
- Quick — Downloads, Desktop, temp, autostart
- Full — every mounted drive
- Custom — any path you name
- Single file — instant verdict
Scan control
- Live progress and file counts
- Pause, resume, cancel
- Parallel with a bounded pool
- Configurable worker threads
- Size caps and exclusions
Quarantine vault
Threats are moved out of reach and stored inert under a per-install key. They cannot execute, and they will not trip other on-access scanners while parked.
Reversible on purpose. Every entry restores byte-for-byte, because false positives happen and you should not lose a file to one.
| Action | What happens |
|---|---|
| Quarantine | File is moved to the vault and obfuscated |
| Restore | Written back to its original path and permissions |
| Delete | Overwritten, then removed permanently |
| Empty | Clears the whole vault |
| Retention | Entries expire automatically by age and count |
Update management
Unpatched software is the most common way a machine gets compromised.
Program updates
Finds outdated software across every package manager on the machine.
aptdnfpacman
flatpaksnapHomebrew
wingetChocolateypip
- Update one package or all of them
- Fixed argument vector, never a shell
- Package names validated before use
- Installing is never implicit
Signature updates
Point it at a JSON manifest and it keeps itself current.
- Downloaded to a temporary file first
- Checked against the manifest digest
- Parsed and validated before install
- A bad download cannot corrupt a working database
Interfaces & automation
Two front ends over one engine, so they can never disagree.
Dashboard
- Eight sections, light and dark
- Live scan progress
- Quarantine review and restore
- Settings, exclusions, schedule
Command line
- Every feature is scriptable
--jsonon every command- Exit 0 clean, 1 threat, 2 error
- Drops straight into cron and CI
Scheduler
- Cron-style expressions
- Recurring quick and full scans
- Automatic signature refresh
- Daily patch check
Activity log
- Every scan, detection and action
- Filter by category
- Full scan and detection history
Configuration
- One JSON file, one data directory
- Path and extension exclusions
- Heuristic sensitivity
- Portable via
GUARDIANTUS_HOME
Embeddable
- Engine has no service dependency
- Import
FileScannerdirectly - Add your own detection layer
- Add your own package manager
Security of the tool itself
The dashboard can quarantine files and install packages, so it is treated as a real attack surface.
| Control | Attack it stops |
|---|---|
| Loopback bind | Remote access to the API |
| Per-run session token | Other local processes driving it |
| Host header validation | DNS rebinding — a visited page controlling your local API |
| Origin validation | Cross-origin requests |
| Strict CSP, no inline script or style | Injected-content execution |
| Resolve-and-recheck static paths | ../ directory traversal |
| Fixed argv, validated package ids | Command injection via package names |
Try it on real files.
The Threat Lab runs the same detection logic in your browser. Nothing is uploaded.