Parameters

Description

--scan-yara [<full path the yara file>]

Required parameter.

Starts YARA scan on the device. The scan is performed according to the rules in the YARA files with the yara or yar extension.

Several values separated by space can be passed to the parameter.

At least one <full path to the yara file> value must be specified if the --path parameter is not specified.

If the --path parameter is also specified in addition to the arguments of the --scan-yara parameter, the scan uses both the files with the YARA rules specified as the arguments and the files from the folder specified by the --path parameter.

--path=<path to the folder with the yara files>

Path to the folder with the YARA files that you want to scan.

Required parameter, if the <full path the yara file> parameter is not specified.

--fast-scan

Optional parameter.

The parameter starts the fast scan mode. For each scan object, one occurrence of the detected marker is logged, and duplicates of the detected markers are not logged. Usage of this parameter allows you to reduce the time for scanning large files.

If the parameter is not passed, standard scan is performed and the duplicates of detected markers are logged.

--tag-hint=<rule tag>

Optional parameter.

The parameter allows considering only the rules with the specified tag during scan. You can specify only one parameter value.
Rules without tags or with tags other than those specified as the parameter value are ignored during scan.

If the parameter is not passed, all the rules are considered during scan.

--id-hint=<rule ID>

Optional parameter.

The parameter allows considering only the rules with the specified ID during scan. You can specify only one parameter value.
Rules without IDs or with IDs other than those specified as the parameter value are ignored during scan.

If the parameter is not passed, all the rules are considered during scan.

--max-rules=<maximum number of scan rules>

Optional parameter.

The parameter sets the limit of unique triggered detection rules; scan stops upon exceeding this limit.

If the parameter value is not specified or equals to 0, the scan is performed without limitations.

--timeout=<stop scan after the specified time in seconds>

Optional parameter.

The parameter specifies the scan duration in seconds. The scan will be stopped after the specified time.

If the parameter value is not specified or equals to 0, the scan is performed without limitations.

--recursive

Optional parameter.

The parameter starts recursive scan of subfolders within the [<list of folders to be scanned>] value.

--scan_folders [<list of folders to be scanned>]

Additionally, you can specify links to argument files with the "@" prefix as arguments of the --scan-folders, --excludes, and --includes parameters.
Argument files are UTF-8 encoded text files that contain lists of objects to be processed using the appropriate command line parameter.

Example:
The my_rules.txt file contains two lines:

• c:\trusted\*.*
• *.abc

The rules2.txt file contains one line:

• img_*.jpg

If you run scan with the parameters like "--scan-folders --exclude *.txt @my_rules.txt *.xml @rules2.txt", all files on all disks will be scanned, except for files with the txt extension, files in the c:\trusted folder, files with the abc extension, files with the xml extension and files with the img_*.jpg mask.

Optional parameter.

The parameter starts scanning of files in the specified list of folders.

If the value of the <list of folders to be scanned> parameter is not specified, scan is performed recursively for all local drives, except for network, cloud and connected drives.

--scan-memory

Optional parameter.

The parameter starts memory scan for all running processes.

--scan-process <process name>

Optional parameter.

The parameter starts memory scan only for specified processes. Standard masks are supported for the <process name> value: "?" and "*".

--max-size=<file size in bytes>

Optional parameter.

Scan is performed only for the files that do not exceed the specified size. Larger files are skipped during scan.

--includes <list of objects to be scanned>

Optional parameter.

The parameter allows you to limit the scan area. You can specify several parameter values separated by a space. Available values:

• File name
• File path
• File name mask
• File path mask

  Passed with the --scan-folders parameter.
  
  Example:
  --scan-folders c:\*.* --recursive --includes *.exe c:\temp\*.* *.dll – scan is performed for all files with the "exe" and "dll" extensions on the C: drive, and all files in the c:\temp folder will be scanned recursively.

--excludes <list of objects to be scanned>

Optional parameter.

The parameter excludes the specified files or folders from scan. You can specify several parameter values separated by a space. Available values:

• File name
• File path
• File name mask
• File path mask

  Passed with the --scan-folders parameter.
  
  Example:
  --scan-folders c:\*.* --excludes readme.txt c:\trusted\*.* *.xml – the readme.txt files, all files from the c:\trusted folder, and all files with the xml extension in the root folder on the C: drive will be skipped during scan.

Offset

Offset in the object scanned by Kaspersky Endpoint Agent.

Data

Signatures searched by Kaspersky Endpoint Agent during scanning.

Object Name

The name of the scanned object.

Rule Name

The name of the rule used during scan.