Below is a test scenario:
- Deploy AWS EFS and mount it to EC2.
- Install Deep Security Agent and docker on the host machine.
- Deploy Ubuntu container mounted to EFS.
docker run -it --name=ubuntu --mount type=volume,dst=<container path>,volume-driver=local,volume-opt=type=none,volume-opt=o=bind,volume-opt=device<EFS/NFS Path> ubuntu
- Drop an EICAR test file inside the container mount point.
echo 'X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*' > eicar.exe
As a result, the malware is detected as a container event.