mediumservicesunverified

Ensure an antimalware protection service is running

antimalware-service-running · RHEL ≥ 8, UBUNTU ≥ 22 · 1 impl

Description

A malicious code protection mechanism must be active on the host. The check accepts any of the antimalware daemons named in the antimalware_services variable, because no CIS or DISA STIG benchmark names a product and sites commonly run a vendor endpoint agent rather than ClamAV.

Rationale

Without an active malicious code protection mechanism, a host has no defense against malware introduced through removable media, downloads, or a compromised account. NIST SP 800-171 requirement 3.14.2 expects protection to be provided at designated locations, and an assessor verifies it by observing the mechanism running.

Check → Remediate

Checkcommand

found=""
for unit in {{ antimalware_services }}; do
  if systemctl is-active "$unit" >/dev/null 2>&1; then
    found="$unit"
    break
  fi
done
if [ -n "$found" ]; then
  echo "OK: antimalware service active: $found"
  exit 0
fi
echo "FAIL: no antimalware service is active. Checked: {{ antimalware_services }}"
echo "If this host runs a product not listed, set it with --var antimalware_services=<unit>"
exit 1

expected_exit:: 0

Remediatemanual

note:: Install and enable the antimalware product approved for this environment, then start its daemon. Kensa does not install or select an antimalware product: the choice is licensed, site-specific, and often mandated, so it is an operator decision. If a product is already running under a unit name Kensa does not know, add it with --var antimalware_services="<unit name>" rather than changing the host.

Framework references

NIST 800-53

SI-3

NIST 800-171

3.14.2[b]

CMMC Level 2

SI.L2-3.14.2

#antimalware#malicious-code#800-171#manual