Views:

Below is a test scenario:

  1. Deploy AWS EFS and mount it to EC2.
  2. Install Deep Security Agent and docker on the host machine.
  3. Deploy Ubuntu container mounted to EFS.
    docker run -it --name=ubuntu --mount type=volume,dst=<container path>,volume-driver=local,volume-opt=type=none,volume-opt=o=bind,volume-opt=device<EFS/NFS Path> ubuntu
  4. Drop an EICAR test file inside the container mount point.
    echo 'X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*' > eicar.exe

As a result, the malware is detected as a container event.
Detected malware on mounted container