Freedom251 › Antivirus software
PRX-SD
What PRX-SD is
PRX-SD is a free, open-source antivirus engine for Linux, macOS, and Windows. It scans files and directories for malware and can monitor directories continuously with its `sd monitor` daemon, which checks new or modified files. Detection combines SHA-256 and MD5 hash lookups, aggregated YARA rules, file-type-aware heuristic checks, optional machine learning, and optional VirusTotal lookups. The documentation describes more than 38,800 YARA rules and heuristics that inspect entropy, suspicious APIs, packing, and timestamps. Dedicated rules and heuristics address ransomware families including WannaCry, LockBit, Conti, REvil, and BlackCat. Detected files can be encrypted and moved to a quarantine vault, with an option to restore them. Linux adds process-memory scanning, kernel rootkit detection, eBPF syscall tracing, and fanotify pre-execution blocking. Optional ClamAV imports and WebAssembly plugins extend detection. Plugins run in a Wasmtime sandbox with configurable limits, while network and filesystem access are disabled by default. PRX-SD requires no cloud dependency or hidden telemetry and is licensed MIT OR Apache-2.0.
Who it suits
It suits security engineers, system administrators, and incident responders needing an open-source scanner across Linux, macOS, and Windows. Linux users also get additional process and kernel-oriented checks.
What it does well
- Free plan for all listed platforms
- Scans files and directories for malware
- Continuous monitoring through `sd monitor`
- Quarantine vault can restore detected files
- No cloud dependency or hidden telemetry
What to know first
- Optional integrations require separate configuration
- WebAssembly plugins have configurable resource limits
- Most Linux-specific defenses do not apply elsewhere
Verdict
PRX-SD combines broad malware detection methods with monitoring, quarantine, and platform-specific Linux defenses. Its free, open-source model and optional integrations make it a configurable choice for technical users.
Facts from PRX-SD's own pages
- Detection
- Its detection pipeline combines hash matching, YARA rules, heuristic analysis, optional machine-learning inference, and optional VirusTotal lookups. · docs.openprx.dev, 12 Oct 2026
- Extensibility
- A WebAssembly plugin system can extend detection logic, add scanners, or integrate proprietary threat feeds. · docs.openprx.dev, 12 Oct 2026
- Free plan
- Yes · github.com, 22 Sept 2026
- Hash matching
- It uses LMDB for O(1) lookups of SHA-256 and MD5 hashes from threat-intelligence sources. · docs.openprx.dev, 12 Oct 2026
- Heuristic analysis
- Its heuristic analysis uses file-type-aware checks including entropy, suspicious APIs, packing, and timestamps. · docs.openprx.dev, 12 Oct 2026
- Integrations
- Optional integrations include VirusTotal lookups, ClamAV signature database imports, and custom WebAssembly plugins. · docs.openprx.dev, 11 Oct 2026
- Intended users
- The documentation describes PRX-SD as designed for security engineers, system administrators, and incident responders. · docs.openprx.dev, 12 Oct 2026
- License
- The product page identifies the license as Apache-2.0. · openprx.dev, 12 Oct 2026
- Linux security
- Linux-specific features include process-memory scanning, kernel rootkit detection, eBPF syscall tracing, and fanotify pre-execution blocking. · docs.openprx.dev, 12 Oct 2026
- Platforms
- The product page lists native support for Linux, macOS, and Windows; the documentation specifies Windows WSL2. · docs.openprx.dev, 12 Oct 2026
- Plugin security
- WebAssembly plugins run in a Wasmtime sandbox with configurable memory and execution limits, while network and filesystem access are disabled by default. · docs.openprx.dev, 11 Oct 2026
- Privacy
- The documentation states that PRX-SD requires no cloud dependency and has no hidden telemetry. · docs.openprx.dev, 12 Oct 2026
- Protection scope
- complete security · github.com, 22 Sept 2026
- Purpose
- PRX-SD is an open-source antivirus engine for scanning files and directories. · openprx.dev, 12 Oct 2026
- Quarantine
- A built-in quarantine vault can isolate, list, and restore detected threats. · openprx.dev, 12 Oct 2026
- Ransomware defense
- The documentation says dedicated YARA rules and heuristics detect ransomware families including WannaCry, LockBit, Conti, REvil, and BlackCat. · docs.openprx.dev, 12 Oct 2026
- Ransomware protection
- Yes · github.com, 22 Sept 2026
- Real-time monitoring
- The daemon monitors directories for new or modified files and scans them automatically. · openprx.dev, 12 Oct 2026
- Supported platforms
- Linux,macOS,Windows · github.com, 22 Sept 2026
- Threat intelligence
- The engine aggregates hash signatures, YARA rules, and indicators from community and open-source threat intelligence sources. · docs.openprx.dev, 11 Oct 2026
- YARA rules
- The documentation describes more than 38,800 YARA rules aggregated from community and commercial-grade sources. · docs.openprx.dev, 12 Oct 2026
Where PRX-SD stands on Freedom251
- Antivirus software#36 of 120