/usr/bin/litmus

Malware classification powered by ML + static analysis

Usage: litmus [OPTIONS] [PATHS]... [COMMAND]

Commands:
  scan          Scan files or directories for hostile/suspicious content
  ps            Scan executables of all running processes
  update-rules  Update models (and optionally cleave traits)
  validate      Validate cleave traits, load the model, and ensure benign samples stay benign
  serve         Run as an HTTP classification server
  worker        Run as a pull-based worker, polling a hopper instance for analysis jobs
  version       Print version information
  help          Print this message or the help of the given subcommand(s)

Arguments:
  [PATHS]...
          Paths to files or directories to scan (shorthand for `litmus scan <paths...>`)

Options:
      --verbose
          Enable debug logging for litmus and cleave

  -u, --update
          Update models and traits before running (failures are non-fatal)

      --light
          Force light-background color theme

      --dark
          Force dark-background color theme

      --model-dir <MODEL_DIR>
          Override model directory (default: auto-resolved from models repo)

      --models-repo <MODELS_REPO>
          Override the models repository URL (env: LITMUS_MODELS_REPO)

      --models-ref <MODELS_REF>
          Override the models repository ref — branch or tag (env: LITMUS_MODELS_REF)

  -f, --format <FORMAT>
          Output format

          Possible values:
          - terminal: Human-readable terminal output
          - json:     Newline-delimited JSON, one object per file

          [default: terminal]

      --threshold-suspicious <THRESHOLD_SUSPICIOUS>
          Override suspicious threshold (0.0-1.0); omit to use model's recommendation

      --threshold-hostile <THRESHOLD_HOSTILE>
          Override hostile threshold (0.0-1.0); omit to use model's recommendation

  -1, --loose
          Use severity level 1: zero-FP targets; least noisy

  -2
          Use severity level 2

  -3
          Use severity level 3: default operating point

  -4
          Use severity level 4

  -5
          Use severity level 5

  -6
          Use severity level 6

  -7
          Use severity level 7

  -8
          Use severity level 8

  -9, --paranoid
          Use severity level 9: most sensitive

      --show <SHOW>
          Classifications to display: hostile, suspicious, sus, benign, all (comma-separated)

          [default: hostile sus]
          [possible values: hostile, sus, benign, all]

      --slow-rule-ms <SLOW_RULE_MS>
          Warn when a single rule takes longer than this many milliseconds

          [default: 4000]

  -h, --help
          Print help (see a summary with '-h')

  -V, --version
          Print version