Everything there is to read
snare is a single bash program with no build step and no
dependencies from a package registry. That keeps the documentation short: install it, learn
about a dozen commands, and understand what it cannot do.
Four ways in, depending on why you are here
Rotate, clean the machine, clean the repositories, tell your collaborators — in that order, and the order is the point.
Not sure Four checks by handRead-only commands against any clone. Nothing to install, about a minute.
Set it up Install and first runmacOS, Linux, Windows or WSL, plus the four commands that matter on day one.
Look something up Command referenceEvery command grouped by purpose, each with the limits written next to it.
It uses your credentials, and stores none
snare ships no token of its own. Every GitHub call goes through the GitHub CLI using your account, which means it can only ever reach what you can already reach.
gh auth login # browser, or paste your own token export GH_TOKEN=... # or an env var
Scopes needed: repo and workflow. Do not use a
token with broader permissions. A scanner does not need to administer your account,
and a token that can do more is a token worth more to whoever steals it.
If you are here because you were compromised
Do not authenticate with a token that existed while the machine was infected. Rotate first, then log in with the new credential — the rotation order is here. This family harvests token files and environment variables, so a token you reuse is a token the operator may already hold.
Adding your own detection patterns
All detection reads a single file. Add a pattern there and every command — scan, guard, hook, shield, CI — picks it up, with no code change.
# a wallet address seen in a new variant
0x[0-9a-fA-F]{40}
# a C2 hostname
eth\.blockscout\.comPatterns are extended regular expressions, one per line, # starts a
comment. The structural heuristic — code, a run of 50+ whitespace characters, then more code —
runs independently of this list, which is why a variant using an address nobody has seen before
is still caught.
If you write a pattern that catches something new, send it in. A variant nobody else can detect yet is the single most useful thing to contribute.
Where snare keeps things
Everything lives under $SNARE_HOME, which defaults to
~/.snare. Nothing is written outside it except the hooks and shield blocks you
explicitly install.
| Path | What is in it |
|---|---|
logs/ | Scan and guard logs, plus saved reports. |
logs/evidence/ | What the guard captured when it killed something — keep this if you plan to report a variant. |
backups/ | Bundle backups written before any fix touches a repository. |
work/ | Scratch clones used during scanning and history rewriting. |
SNARE_ROOT overrides where snare looks for its own library files —
useful if you installed it somewhere unusual and the launcher cannot resolve
lib/.
Every page on this site
| Page | What it covers |
|---|---|
| The threat | Both execution routes, the hidden-payload specimen, and how the C2 address is read off the blockchain. |
| Check your machine | Four read-only checks, and how to read a clean result honestly. |
| If you're infected | Rotate, clean the machine, clean the repositories, notify — in order. |
| Install | macOS, Linux, Windows, WSL, requirements, and first run. |
| Command reference | Every command, grouped by purpose, with its limits. |
| Limits | What snare does not do — read this before trusting it. |
| Changelog | Every release, false-clean defects listed first. |
| Community | Discussions, field reports, and the questions still open. |
| Report a bug | What to report and how — a false clean above all. |