NAME:
   malcontent - Detect malicious program behaviors

USAGE:
   mal [GLOBAL FLAGS] <command> [COMMAND FLAGS] <path>

VERSION:
   v1.28.1

COMMANDS:
   analyze  fully interrogate a path
   diff     scan and diff two paths
   refresh  Refresh test data
   scan     tersely scan a path and return findings of the highest severity
   help, h  Shows a list of commands or help for one command

GLOBAL OPTIONS:
   --all                                              Ignore nothing within a provided scan path
   --exit-extraction                                  Exit when encountering file extraction errors
   --exit-on-extractor-panic                          Terminate the process when an archive extractor panics instead of logging and continuing
   --exit-first-miss                                  Exit with status 1 if scan source has no matching capabilities
   --exit-first-hit                                   Exit with status 1 if scan source has matching capabilities
   --format string                                    Output format (interactive, json, markdown, simple, strings, terminal, yaml) (default: "auto")
   --ignore-rules string                              YARA rule names to ignore (comma-separated; supports filepath.Match globs, e.g. 'py_lib_alias_val,py_lib_*'). Ignored rules are removed from the report before overall risk is computed.
   --ignore-self                                      Ignore the malcontent binary
   --ignore-tags string                               Rule tags to ignore (default: "false_positive,ignore")
   --include-data-files                               Include files that are detected as non-program (binary or source) files
   --jobs int, -j int                                 Concurrently scan files within target scan paths (effectively capped at GOMAXPROCS; higher values do not increase throughput) (default: 64)
   --max-depth int                                    Maximum depth for archive extraction (0 or -1 for unlimited) (default: 32)
   --max-files int                                    Maximum number of files to scan (0 or -1 for unlimited) (default: 2097152)
   --max-image-size int                               Maximum OCI image size in bytes (0 or -1 for unlimited) (default: 17179869184)
   --max-archive-bytes int                            Maximum total uncompressed bytes produced by extracting an archive and every archive nested in it, counting 4 KiB for each entry besides its content (0 for the built-in default) (default: 34359738368)
   --max-archive-ratio float                          Maximum uncompressed:compressed expansion ratio for archive extraction (0 or less for the built-in default) (default: 100)
   --min-file-level int                               Obsoleted by --min-file-risk (default: -1)
   --min-file-risk string                             Only show results for files which meet the given risk level (any, low, medium, high, critical) (default: "low")
   --min-level int                                    Obsoleted by --min-risk (default: -1)
   --min-risk string                                  Only show results which meet the given risk level (any, low, medium, high, critical) (default: "low")
   --oci-auth                                         Authenticate OCI pulls with MALCONTENT_REGISTRY_USER/PASS, scoped to the registry in MALCONTENT_REGISTRY_HOST
   --ca-bundle string                                 OCI registry CA bundle: system (default; use OS trust store) or absolute path to a PEM bundle (default: "system")
   --oci-pull-timeout-seconds int                     OCI registry response-header timeout in seconds (<=0 uses the built-in default) (default: 600)
   --oci-retry-max-attempts int                       Maximum OCI registry pull retry attempts (<=0 uses the built-in default) (default: 3)
   --oci-retry-max-window-seconds int                 Maximum OCI registry pull retry backoff window in seconds (<=0 uses the built-in default) (default: 60)
   --oci-per-host-slots int                           Maximum concurrent OCI pulls per registry host (<=0 uses the built-in default) (default: 4)
   --oci-keepalive-policy string                      OCI transport keepalive policy (enabled, disabled, go-default) (default: "enabled")
   --oci-keepalive-seconds int                        OCI transport idle-connection timeout in seconds when keepalive policy is enabled (default: 30)
   --oci-proxy-opt-in                                 Honor HTTP(S)_PROXY environment variables for OCI registry traffic
   --oci-allow-insecure-auth                          Allow --oci-auth credentials to be sent to a registry over plain HTTP
   --oci-pull-deadline-seconds int                    Maximum seconds for a whole OCI image pull and extraction (0 for no deadline) (default: 3600)
   --platform string                                  OCI image index platforms to scan as comma-separated os/arch[/variant] (default: all)
   --output string, -o string                         Write output to specified file instead of stdout
   --profile, -p                                      Generate profile and trace files
   --quantity-increases-risk                          Increase file risk score based on behavior quantity
   --rule-category string [ --rule-category string ]  Only show matches whose rule path starts with one of the given categories (e.g. exfil, exfil/stealer); repeatable, no-op when unset
   --stats, -s                                        Show scan statistics
   --third-party                                      Include third-party rules which may have licensing restrictions
   --verbose                                          Emit verbose logging messages to stderr
   --help, -h                                         show help
   --version, -v                                      print the version