Spring: Progress Report 5

Overview:
To demonstrate the ability of Herd management system over free management tools like Ansible, we have added a functionality to integrate with the system’s native antivirus agent to ensure that system administrators are notified in a timely manner if threats are discovered on their machine.

For Linux systems, because there is no default AV installed in the majority of distributions, we have also added a task to install ClamAV.[^1]

Specific Tools Used and Implementation:
The task template to install an antivirus on Linux, as previously mentioned, will install ClamAV using APT, or notify the system administrator that the system is not APT-based. On Windows, the install AV task will report whether Defender is functioning properly or not, instructing the Administrator to take action and enable it, if it has been disabled somehow.[^2]

When the administrator selects a host, or multiple hosts, to run the av_scan task, an optional argument for the path to scan is provided, and defaults to / if unspecified. On Linux systems with multiple users, for example, it may be most useful to scan the /home directory, rather than system directories. Additionally, an administrator may wish to break scans down into multiple separate sessions targeting different directories, as in our testing, resource-constrained machines will take an exorbitant amount of time to scan the whole partition recursively from /. The Windows execution of this task is a Powershell command that requests for Defender to scan the given path, which defaults to C:\ if not specified by the administrator.

Proof of Work/Documentation:

This screenshot shows the install_av task, how it requests an apt-get command if the OS is Linux and apt-get is a valid executable. On Windows, we use Get-MpComputerStatus to check the result of .AntivirusEnabled to verify that later calls to Start-MpScan will work correctly.

(Full code [here](https://github.com/capybarastone/endpoint/blob/main/task_utils.go#L65))

This screenshot shows the av_scan task, handling the default path based on OS, and running the appropriate command.
(Full code here)

Shown below is the UI of an administrator submitting a task for a clamav scan of /home/matt/ccdc2026

The results of the above task are displayed below, thankfully discovering no threats.

The results of a new AV task to scan /home/matt/SAMPLESCAN, in which we placed an EICAR file.

[^1]: For now, this is limited to APT-based systems, as all of our testing VMs were APT-based distributions, but this would be trivial to expand in the future to support other package managers.

[^2]: In the future, it may be worth exploring if other mainstream AV tools have PowerShell control libraries, which would enable us to hook into them. (Justification: other AV tools get quicker virus definition updates than defender, and we certainly did not have the scope in the course of this project to compete with them.)