Below is a test scenario:

1. Deploy AWS EFS and mount it to EC2.
2. Install Deep Security Agent and docker on the host machine.
3. Deploy Ubuntu container mounted to EFS.

   docker run -it --name=ubuntu --mount type=volume,dst=<container path>,volume-driver=local,volume-opt=type=none,volume-opt=o=bind,volume-opt=device<EFS/NFS Path> ubuntu

4. Drop an EICAR test file inside the container mount point.

   echo 'X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*' > eicar.exe

As a result, the malware is detected as a container event.