Overview:
To demonstrate the ability of Herd management system over free management tools like Ansible, we have added a functionality to integrate with the system’s native antivirus agent to ensure that system administrators are notified in a timely manner if threats are discovered on their machine.
For Linux systems, because there is no default AV installed in the majority of distributions, we have also added a task to install ClamAV.1
Specific Tools Used and Implementation:
The task template to install an antivirus on Linux, as previously mentioned, will install ClamAV using APT, or notify the system administrator that the system is not APT-based. On Windows, the install AV task will report whether Defender is functioning properly or not, instructing the Administrator to take action and enable it, if it has been disabled somehow.2
When the administrator selects a host, or multiple hosts, to run the av_scan task, an optional argument for the path to scan is provided, and defaults to / if unspecified. On Linux systems with multiple users, for example, it may be most useful to scan the /home directory, rather than system directories. Additionally, an administrator may wish to break scans down into multiple separate sessions targeting different directories, as in our testing, resource-constrained machines will take an exorbitant amount of time to scan the whole partition recursively from /. The Windows execution of this task is a Powershell command that requests for Defender to scan the given path, which defaults to C:\ if not specified by the administrator.
Proof of Work/Documentation:
This screenshot shows the install_av task, how it requests an apt-get command if the OS is Linux and apt-get is a valid executable. On Windows, we use Get-MpComputerStatus to check the result of .AntivirusEnabled to verify that later calls to Start-MpScan will work correctly.
This screenshot shows the av_scan task, handling the default path based on OS, and running the appropriate command.
(Full code here)
Shown below is the UI of an administrator submitting a task for a clamav scan of /home/matt/ccdc2026
The results of the above task are displayed below, thankfully discovering no threats.
The results of a new AV task to scan /home/matt/SAMPLESCAN, in which we placed an EICAR file.
-
For now, this is limited to APT-based systems, as all of our testing VMs were APT-based distributions, but this would be trivial to expand in the future to support other package managers. ↩︎
-
In the future, it may be worth exploring if other mainstream AV tools have PowerShell control libraries, which would enable us to hook into them. (Justification: other AV tools get quicker virus definition updates than defender, and we certainly did not have the scope in the course of this project to compete with them.) ↩︎