mediumservicesunverified

Ensure antimalware scans are scheduled

antimalware-scheduled-scan · RHEL ≥ 8, UBUNTU ≥ 22 · 1 impl

Description

A periodic malicious code scan must be scheduled. The check accepts an enabled systemd timer or a cron entry whose name matches one of the scan unit patterns in the antimalware_scan_units variable.

Rationale

Real-time scanning inspects files as they are accessed, so malware written to a path nobody opens can persist indefinitely. A scheduled full scan is what finds it. NIST SP 800-171 requirement 3.14.5 expects scans to be performed at a defined frequency, and the frequency itself is the organization's to set.

Check → Remediate

Checkcommand

found=""
for unit in {{ antimalware_scan_units }}; do
  if systemctl is-enabled "$unit" >/dev/null 2>&1; then
    found="timer $unit"
    break
  fi
done
if [ -z "$found" ]; then
  hits=$(grep -rIl -- "{{ antimalware_scan_cron_match }}" /etc/cron.d /etc/crontab /etc/cron.daily /etc/cron.weekly 2>/dev/null | head -1)
  if [ -n "$hits" ]; then
    found="cron entry $hits"
  fi
fi
if [ -n "$found" ]; then
  echo "OK: a scheduled antimalware scan is configured: $found"
  exit 0
fi
echo "FAIL: no scheduled antimalware scan was found. Checked timers: {{ antimalware_scan_units }}"
echo "If a scan is scheduled another way, set it with --var antimalware_scan_units=<timer>"
exit 1

expected_exit:: 0

Remediatemanual

note:: Schedule a periodic full scan using the antimalware product in use, at the frequency the organization defined. Kensa does not create the schedule, because a full scan is resource-intensive and its timing has to be agreed against the host's change and maintenance windows.

Framework references

NIST 800-53

SI-3

NIST 800-171

3.14.5[b]

CMMC Level 2

SI.L2-3.14.5

#antimalware#malicious-code#800-171#manual