Atomdrift Scan

Atomdrift Scan is a modern ML-based malware scanner designed to detect 0-day attacks against the software supply-chain.

It's designed to be deterministic, fast, and flexible, and embeddable in any workflow or security tool you have in mind, and can operate against files, archives, URLs, PURLs, or processes.

As of August 2026, Atomdrift Scan has a 82% 0-day detection rate, +18% ahead of any other scanner: commercial or open.

How does Atomdrift get such great results? First, it covers more ground than any other scanner:

• 100+ supported file formats: from C source to ELF to PDF
• 100,000+ detection rules covering malware on every platform from AIX to iOS to Windows
• 4,000,000+ hashes for known good/badware
• Integrated AST analysis using tree-sitter
• Automated binary reverse engineering via rizin

Most importantly, rules are constantly refreshed using reinforcement learning against new samples, blogs, and technical articles, resulting in ~1000 updated rules daily.

If you are an a UNIX-flavored host (macOS, Linux, BSD, Solaris, illumos, Android):

curl -fsSL https://install.atomdrift.org/scan.sh | sh

If you are on Windows:

irm https://install.atomdrift.org/scan.ps1 | iex

Or, if you have Rust installed and just want to build it from source:

make install

If deeper binary analysis is required, you should also install 7-Zip, rizin, upx, and innoextract. Install upstream 7-Zip (brew install sevenzip, apt install 7zip) rather than p7zip — its 7z cannot read APFS, so .dmg contents go unscanned.

# Scan a file, directory, or archive recusively:
atomscan ./project
atomscan release.tgz

# Fetch a package from its registry and scan it.
atomscan purl npm/[email protected]

# Fetch and scan a URL.
atomscan url https://example.com/download

# EXPERIMENTAL: Scan running process executables, or triage the wider host
atomscan ps
atomscan sys

# JSON output for programmatic access
atomscan -f json ./project

Exit codes make CI integration trivial:

• 0: all samples are benign
• 1: hostile sample detected
• 2: suspicious sample detected
• 3 or more: analysis error

1. stng extracts content, even if obfuscated
2. cleave unpacks containers and extracts capabilities
3. The report is converted into a standardized feature vector, standardized across file types.
4. azoth LightGBM model ensembles score the sample.

atomscan will never send telemetry data. It will however reach out to the Internet for 2 reasons:

• rule updates: every 24h, can be disabled using --no-update or SCAN_NO_UPDATE_CHECK=1
• dependency fetching: to detect if a benign package depends on downloading a compromised package or payload. Set --fetch=none to prevent this.

Unlike other malware scanners, Atomdrift allows you to adjust sensitivity in terms of an acceptable false-positive level using the -l flag:

• -l0: tight, sets the confidence cutoff to a point where no false-positives have been observed.
• -l25: the default shipping point: 25 false-positives per 100 million files.
• -l1000: loose, roughly 1 false positive per 100,000 files.

NOTE: For file formats where we don't have 100 million samples, the observed false-positive rate may be up to 5-6X the requested level. YMMV.

Raw --threshold-hostile and --threshold-suspicious overrides are available for users who want to micromanage probability thresholds directly, but these numbers are not guaranteed to be stable, and these flags cannot be combined with -l.

For additional interpretation, users can provide access to an LLM via the --llm flag. This flag serves two purposes:

• Provides a large-language model text interpretation of the results
• Steer edge cases based on agreement/disagreement with the ML model ( p to 33%)

By default, atomscan sends the interpreted evidence (not the original file) to http://localhost:8000/v1 - to be used with a local service like Ollama or vLLM; but it can also be setup to use a remote service like Claude, ChatGPT, or DeepSeek.

atomscan --llm ./project
atomscan --llm http://model-host:8000/v1 --llm-model my-model ./project

The scanner recognizes more than 100 file and container types. Representative coverage includes:

The rule set includes platform-specific behaviors for Linux, macOS, Windows, Android, iOS, the BSDs, AIX, Solaris, QNX, z/OS, ESXi, OpenWrt, VxWorks, RouterOS, FortiOS, PAN-OS, IOS-XE, Junos, NetScaler, and Ivanti appliances.

The default build matrix covers Linux, macOS, FreeBSD, OpenBSD, NetBSD, illumos, Solaris, and Windows across several CPU architectures. Test depth varies by target; see the build workflow for the current matrix.

• Integration guide — CLI, server, worker, exit codes, and deployment choices
• JSON report schema — machine-readable output fields
• Server API — long-running HTTP service
• Workers — distributed scanning with hopper
• Dependency behavior — fetched dependency graph and provenance

• cleave — capability extraction and static analysis
• azoth — model weights, thresholds, and feature specification
• hopper — distributed work queue
• Atomdrift Lab — free sample analysis

Atomdrift Scan is available under the Apache License 2.0.

All contributions welcome!