Hunting OLE & VBA threats in email.
Mailstrix is the owl that finds malware hiding in your mail. It takes hostile attachments apart — unwrapping OLE2/OOXML, VBA, RTF objects, PDFs, archives and nested carriers — until YARA detection rules can finally see the dangerous bits. It runs out-of-process behind Rspamd (async HTTP), SpamAssassin, an ICAP server, Dovecot Sieve, or standalone, so attachment analysis never blocks the mail worker.
A standalone scanner for mail messages and attachments. Your mail stack asks it to inspect suspicious content.
YARA can only match what it is given. Mailstrix feeds YARA the decoded macro, script, link or executable instead of only the outer wrapper.
Beside rspamd, SpamAssassin, Dovecot Sieve, ICAP gateways, or a standalone workflow.
It fails open: mail delivery is not blocked, but the error is counted in metrics so operators can alert on it.
strixd.OLE, OOXML, RTF, XLM, BIFF and VBA pulled apart and decompressed to cleartext — the real moat, not the matcher.
zip, rar, 7z, cab, jar, apk, tar, gz — including nested batch droppers, scanned to the bottom layer.
Parses the formats attackers abuse precisely because most scanners don't look inside them.
Carves embedded executables out of containers and documents for direct inspection.
Swappable YARA back-end runs against the decoded cleartext, so obfuscation doesn't hide the signature.
Optional abuse.ch malware-URL intelligence on links found inside extracted content.
Hashes every attachment and checks the SHA-256 against the abuse.ch MalwareBazaar corpus — known samples flagged instantly.
Scans over HTTP so your mail event loop never blocks and libyara stays out of the gateway image — the gozer/DRP pattern.
Maps the attachment name to YARA filename/extension externals, so name-keyed THOR / Loki rules fire correctly.
LRU+TTL cache with optional Redis L2 and singleflight — a message to N recipients is scanned once, not N times.
A /metrics endpoint exposes scans, matches, errors, cache hits and feed stats — drop straight into Grafana.
Parse errors never block mail; a SIGHUP reloads rules and flushes the cache with zero downtime.
strixd + scanner CLI strix-scan, no gateway required.docker run -d --name mailstrix \
-p 8079:8079 \
eilandert/mailstrix:latestAlso ships as a Debian package and a Helm chart. See the full syntax & synopsis for every environment variable, CLI subcommand and HTTP endpoint, or the GitHub repository for full deployment docs.
Latest release: v1.1.0 — static amd64/arm64 binaries, .deb packages and SHA256SUMS on the release page.
A standalone mail-attachment malware scanner. It recursively unpacks attachments to their cleartext payload and matches them with YARA, catching malware hidden inside macros, archives and obfuscated office documents.
Five ways: an rspamd Lua module, a SpamAssassin Perl plugin, a Dovecot Sieve wrapper, an ICAP service, or a standalone daemon and scanner CLI.
The image bakes ~10,000 public rules from eight curated sources at build time, precompiled to .yac and rebuilt daily. Mailstrix doesn't author rules — it packages other people's work, and every set keeps its own upstream license:
| Ruleset | Source | License |
|---|---|---|
| YARA-Forge | YARAHQ/yara-forge | aggregator (each rule keeps its upstream license) |
| signature-base | Neo23x0/signature-base | DRL 1.1 |
| Didier Stevens Suite | DidierStevens/DidierStevensSuite | public domain |
| bartblaze/Yara-rules | bartblaze/Yara-rules | MIT |
| InQuest yara-rules-vt | InQuest/yara-rules-vt | MIT |
| ANY.RUN | anyrun/YARA | per-repo |
| CAPEv2 (curated) | kevoreilly/CAPEv2 | per-repo |
| YARAify | abuse.ch YARAhub | CC0 |
Any source can be pinned or toggled off with a build arg (YARAFORGE_SET, DIDIER=0, BARTBLAZE=0, INQUEST=0, YARAIFY=0, …).
Free and open source. Mailstrix itself is MIT. Dependencies are permissive (go-yara BSD-2, oleparse MIT, the Redis client BSD/Apache). The baked rule sets keep their own upstream licenses — see the ruleset table above.
Money for coffee is always appreciated though — there's a donate button on the contact page. And if you're really making big bucks off this, don't forget us! We need a coffee drip :-)
libyara is a C library (CGO). Running it inside an rspamd or Dovecot worker would block the event loop and drag a heavy C dependency into the mail image. As a separate HTTP service the caller stays async, the scanner scales independently, and the MTA image stays lean. The Sieve/LDA path uses strix-scan, a CGO-free client, for boxes that can't link libyara at all.
Set MAILSTRIX_TOKEN (or MAILSTRIX_TOKEN_FILE); callers must then send it as a Bearer header or X-MAILSTRIX-Token. The body size is capped (MAILSTRIX_MAX_BODY) and concurrency is gated, because anyone who can reach the port can submit CPU-costly scans. Bind it to a private network or loopback — never expose /scan to the public internet.
Work scales with the effort level (1 = raw bytes + shallow extraction, max = full recursive depth). Set MAILSTRIX_EFFORT=auto and it derives the level from admission-gate pressure — full depth when idle, shedding a level at a time as in-flight scans fill the gate and climbing back as it drains. MAILSTRIX_MAX_CONCURRENT (default = CPU count) gates libyara scans and MAILSTRIX_MAX_INFLIGHT (default 2×) is the admission gate. Sizing profiles with expected p95 and RPS are in the README.
It fails open, always. A scan error, timeout, or libyara panic is reported as "no match" rather than blocking the message — a malware scanner must never become a mail-delivery outage. Errors are still counted in Prometheus so you can alert on them.
Linux on amd64 and arm64. Every release ships a Docker image, a Debian/Ubuntu .deb for both arches, and static strixd / strix-scan binaries with SHA256SUMS. A Helm chart is included for Kubernetes.
Mailstrix is one piece of a larger mail-hardening stack. Our other open-source mail work:
And the long-form reading — cornerstone articles on the MyGUARD blog about building a modern mail stack: