--- etc/clamd.conf.macports
+++ etc/clamd.conf.macports	2023-12-09 13:14:35
@@ -5,13 +5,13 @@
 
 
 # Comment or remove the line below.
-Example
+#Example
 
 # Uncomment this option to enable logging.
 # LogFile must be writable for the user running daemon.
 # A full path is required.
 # Default: disabled
-#LogFile /tmp/clamd.log
+LogFile @PREFIX@/var/log/clamav/clamd.log
 
 # By default the log file is locked for writing - the lock protects against
 # running clamd multiple times (if want to run another clamd, please
@@ -28,7 +28,7 @@
 # in bytes just don't use modifiers. If LogFileMaxSize is enabled, log
 # rotation (the LogRotate option) will always be enabled.
 # Default: 1M
-#LogFileMaxSize 2M
+LogFileMaxSize 2M
 
 # Log time with each message.
 # Default: no
@@ -66,7 +66,7 @@
 
 # Log additional information about the infected file, such as its
 # size and hash, together with the virus name.
-#ExtendedDetectionInfo yes
+ExtendedDetectionInfo yes
 
 # This option allows you to save a process identifier of the listening
 # daemon.
@@ -74,7 +74,7 @@
 # It is recommended that the directory where this file is stored is
 # also owned by root to keep other users from tampering with it.
 # Default: disabled
-#PidFile /run/clamav/clamd.pid
+PidFile @PREFIX@/var/run/clamav/clamd.pid
 
 # Optional path to the global temporary directory.
 # Default: system specific (usually /tmp or /var/tmp).
@@ -98,8 +98,7 @@
 
 # Path to a local socket file the daemon will listen on.
 # Default: disabled (must be specified by a user)
-#LocalSocket /run/clamav/clamd.sock
-#LocalSocket /tmp/clamd.sock
+LocalSocket @PREFIX@/var/run/clamav/clamd.socket
 
 # Sets the group ownership on the unix socket.
 # Default: disabled (the primary group of the user running clamd)
@@ -146,7 +145,7 @@
 
 # Maximum number of threads running at the same time.
 # Default: 10
-#MaxThreads 20
+MaxThreads 6
 
 # Waiting for data from a client socket will timeout after this time (seconds).
 # Default: 120
@@ -185,9 +184,107 @@
 #ExcludePath ^/proc/
 #ExcludePath ^/sys/
 
+# BRE regex References:
+# https://www.clamav.net/documents/phishsigs#Introduction-to-regular
+# https://forum.netgate.com/topic/102819/alternate-definitions-for-clamav/10
+# http://ftp.swin.edu.au/sanesecurity/foxhole_filename.cdb
+
+# Exclude these attached volumes that `CrossFilesystems` doesn't prevent
+
+# Exclude all attached volumes
+#ExcludePath ^/Volumes/
+
+# Exclude every volume that's not named /Volumes/Macintosh HD/
+# Note: Use with `FollowDirectorySymlinks no`. The default is this directory
+# is a symlink, and will not be scanned; otherwise scan if it's an attached volume
+ExcludePath ^/Volumes/([^M]|M([^a]|a([^c]|c([^i]|i([^n]|n([^t]|t([^o]|o([^s]|s([^h]|h([^ ]|[ ]([^H]|H([^D]|D([^/])|$)|$)|$)|$)|$)|$)|$)|$)|$)|$)|$))[^/]{0,240}/
+
+ExcludePath ^/Network/
+ExcludePath ^/Quarantine/
+ExcludePath ^/opt/Quarantine/
+ExcludePath ^/dev/
+ExcludePath /.dbfseventsd$
+# macOS SIP https://support.apple.com/en-us/HT204899
+# ls -leOd /*  | grep restricted
+ExcludePath ^/System/
+ExcludePath ^/bin/
+ExcludePath ^/etc/
+ExcludePath ^/sbin/
+ExcludePath ^/tmp/
+ExcludePath ^/usr/
+ExcludePath ^/var/
+# ls -leOd /usr/* | grep restricted | perl -lane 'chomp; s/.+\/usr\/(.+)/$1/; print "ExcludePath ^/usr/$_/";'
+ExcludePath ^/usr/X11/
+ExcludePath ^/usr/X11R6/
+ExcludePath ^/usr/bin/
+ExcludePath ^/usr/lib/
+ExcludePath ^/usr/libexec/
+ExcludePath ^/usr/sbin/
+ExcludePath ^/usr/share/
+ExcludePath ^/usr/standalone/
+# ls -leOd /Applications/* | grep restricted | perl -lane 'chomp; s/.+\/Applications\/(.+\.app)/$1/; print "ExcludePath ^/Applications/$_/";'
+ExcludePath ^/Applications/App Store.app/
+ExcludePath ^/Applications/Automator.app/
+ExcludePath ^/Applications/Books.app/
+ExcludePath ^/Applications/Calculator.app/
+ExcludePath ^/Applications/Calendar.app/
+ExcludePath ^/Applications/Chess.app/
+ExcludePath ^/Applications/Contacts.app/
+ExcludePath ^/Applications/Dashboard.app/
+ExcludePath ^/Applications/Dictionary.app/
+ExcludePath ^/Applications/FaceTime.app/
+ExcludePath ^/Applications/Font Book.app/
+ExcludePath ^/Applications/Home.app/
+ExcludePath ^/Applications/Image Capture.app/
+ExcludePath ^/Applications/Launchpad.app/
+ExcludePath ^/Applications/Mail.app/
+ExcludePath ^/Applications/Maps.app/
+ExcludePath ^/Applications/Messages.app/
+ExcludePath ^/Applications/Mission Control.app/
+ExcludePath ^/Applications/News.app/
+ExcludePath ^/Applications/Notes.app/
+ExcludePath ^/Applications/Photo Booth.app/
+ExcludePath ^/Applications/Photos.app/
+ExcludePath ^/Applications/Preview.app/
+ExcludePath ^/Applications/QuickTime Player.app/
+ExcludePath ^/Applications/Reminders.app/
+ExcludePath ^/Applications/Safari.app/
+ExcludePath ^/Applications/Siri.app/
+ExcludePath ^/Applications/Stickies.app/
+ExcludePath ^/Applications/Stocks.app/
+ExcludePath ^/Applications/System Preferences.app/
+ExcludePath ^/Applications/TextEdit.app/
+ExcludePath ^/Applications/Time Machine.app/
+ExcludePath ^/Applications/VoiceMemos.app/
+ExcludePath ^/Applications/iTunes.app/
+# ls -leOd /Applications/Utilities/* | grep restricted | perl -lane 'chomp; s/.+\/Applications\/(.+\.app)/$1/; print "ExcludePath ^/Applications/$_/";'
+ExcludePath ^/Applications/Utilities/Activity Monitor.app/
+ExcludePath ^/Applications/Utilities/AirPort Utility.app/
+ExcludePath ^/Applications/Utilities/Audio MIDI Setup.app/
+ExcludePath ^/Applications/Utilities/Bluetooth File Exchange.app/
+ExcludePath ^/Applications/Utilities/Boot Camp Assistant.app/
+ExcludePath ^/Applications/Utilities/ColorSync Utility.app/
+ExcludePath ^/Applications/Utilities/Console.app/
+ExcludePath ^/Applications/Utilities/Digital Color Meter.app/
+ExcludePath ^/Applications/Utilities/Disk Utility.app/
+ExcludePath ^/Applications/Utilities/Grapher.app/
+ExcludePath ^/Applications/Utilities/Keychain Access.app/
+ExcludePath ^/Applications/Utilities/Migration Assistant.app/
+ExcludePath ^/Applications/Utilities/Screenshot.app/
+ExcludePath ^/Applications/Utilities/Script Editor.app/
+ExcludePath ^/Applications/Utilities/System Information.app/
+ExcludePath ^/Applications/Utilities/Terminal.app/
+ExcludePath ^/Applications/Utilities/VoiceOver Utility.app/
+
+# exclude these local package directories that have detectable signatures
+# snort
+ExcludePath ^/usr/local/etc/snort/rules/
+# rspamd
+ExcludePath ^@PREFIX@/var/macports/distfiles/rspamd/
+
 # Maximum depth directories are scanned at.
 # Default: 15
-#MaxDirectoryRecursion 20
+MaxDirectoryRecursion 30
 
 # Follow directory symlinks.
 # Default: no
@@ -231,7 +328,7 @@
 
 # Don't fork into background.
 # Default: no
-#Foreground yes
+Foreground yes
 
 # Enable debug messages in libclamav.
 # Default: no
@@ -255,7 +352,7 @@
 
 # Detect Possibly Unwanted Applications.
 # Default: no
-#DetectPUA yes
+DetectPUA yes
 
 # Exclude a specific PUA category. This directive can be used multiple times.
 # See https://github.com/vrtadmin/clamav-faq/blob/master/faq/faq-pua.md for
@@ -270,6 +367,11 @@
 #IncludePUA Spy
 #IncludePUA Scanner
 #IncludePUA RAT
+
+IncludePUA RAT
+IncludePUA Spy
+IncludePUA Server
+IncludePUA Script
 
 # This option causes memory or nested map scans to dump the content to disk.
 # If you turn on this option, more data is written to disk and is available
