Automated Rule-based Guardian for Unified Security
ARGUS is an open-source, modular malware detection platform developed by Biswadeb's Lab for malware analysts, DFIR practitioners, incident responders, and detection engineers.
Rather than requiring analysts to manually locate, organize, and execute hundreds of YARA rules, ARGUS automatically synchronizes supported rule sources, compiles them into a unified detection engine, and scans files or directories using the complete rule collection.
Built in Go, ARGUS is designed to simplify rule-based malware detection while providing a scalable foundation for future detection engines, threat intelligence integrations, and defensive security capabilities.
Managing large YARA rule collections is an operational challenge.
Rules are often distributed across multiple repositories, malware families, and research projects. During investigations, analysts frequently spend unnecessary time locating and maintaining rule sets before analysis can even begin.
ARGUS removes that operational overhead.
Instead of manually maintaining rule collections, ARGUS automatically synchronizes supported repositories, prepares the local rule database, compiles the available rules into a single detection engine, and performs malware detection through a single command.
The objective is simple:
- Reduce manual rule management
- Simplify malware analysis workflows
- Make large rule collections practical to use
- Provide a modular detection platform that evolves with modern threat detection
- Automatic synchronization of ransomware YARA rules from Ransomware.live
- Unified YARA detection engine
- Recursive file and directory scanning
- Multi-algorithm hashing (MD5, SHA1, SHA256)
- Hash blocklist detection
- Shannon entropy analysis
- Structured JSON reporting
- Configurable logging
- Modular architecture for future detection engines and intelligence sources
git clone https://github.com/Biswadebs-Lab/Argus.git
cd ARGUS
go mod tidy
go build -o argus .- Go 1.24 or later
- YARA
- libyara development libraries
sudo apt update
sudo apt install -y yara libyara-dev pkg-configsudo pacman -S yarabrew install yaraScan an entire directory:
./argus ./SamplesScan a single file:
./argus suspicious.exeRun directly during development:
go run . ./SamplesARGUS is configured through config.yaml.
Configuration options include:
- Rule repository configuration
- Rule synchronization
- Scanner behaviour
- Hash algorithms
- Reporting
- Logging
The configuration file is automatically generated on first launch and can be customized as required.
Additional project documentation is included in this repository.
| Document | Description |
|---|---|
| PROJECTS.md | Architecture, modules, design philosophy, and implementation details |
| LICENSE | MIT License |
ARGUS does not create or maintain the ransomware YARA rules used for detection.
By default, ARGUS synchronizes its ransomware rule collection from https://ransomware.live.
Their continuous effort in collecting, maintaining, and publishing high-quality ransomware detection rules makes this capability possible.
Biswadeb's Lab would like to thank the Ransomware.live team, malware researchers, and all rule authors whose work supports the malware analysis and DFIR community.
If ARGUS is useful in your workflow, please consider supporting and referencing the original rule source.
ARGUS is designed as a long-term malware detection platform.
Planned capabilities include:
- Additional rule repositories
- Multiple detection engines
- Archive scanning
- Process scanning
- Memory scanning
- Threat intelligence enrichment
- IOC correlation
- STIX integration
- MISP integration
- SIEM integrations
- Scheduled rule synchronization
- Plugin framework
ARGUS is intended for malware analysis, digital forensics, incident response, detection engineering, and authorized security research.
Users are responsible for ensuring that the software is used in accordance with applicable laws, organizational policies, and authorization requirements.
Developed and maintained by Biswadeb's Lab.
- Website: https://official-biswadeb941.in
- GitHub: https://github.com/Biswadebs-Lab
Copyright © 2026 Biswadeb's Lab
Released under the MIT License.