EVD-Q5 — Anti-Malware Solution Evidence

PCI DSS v4.0 Requirement 5 — Protect All Systems and Networks from Malicious Software

OwnerGabriel Ureña · CTO

QSA ReviewerElswick Lai · ControlCase

AV SolutionClamAV 1.4.4

Deployed2026-07-01

Status✓ ACTIVE

Total Signatures3,642,506

Scope: All CDE components — Collector droplet, DOKS worker nodes (cde + app pools), CDD (10.100.0.11), VAPT (10.100.0.12).

Complementary controls: Falco (eBPF-based continuous behavioral analysis) + Windows Defender (CDD/VAPT hosts).

---

1. Sub-requirement coverage matrix

Sub-req	Requirement	Status	Evidence
5.2.1	Anti-malware deployed on all CDE components	Pass	§2 (deployment inventory)
5.2.2	Auto-update signatures enabled	Pass	§3 (freshclam every 6h)
5.2.3	Periodic scans + continuous behavioral analysis	Pass	§4 (daily cron + Falco)
5.3.1	Anti-malware kept current, actively running	Pass	§5 (systemctl + K8s status)
5.3.4	Audit logs enabled + centralized	Pass	§6 (Rapid7 forwarder)
5.3.5	User cannot disable/modify AV	Pass	§7 (permissions + chattr +i)
10.5.1	Log retention 3mo online / 9mo offline	Pass	§6.3 (logrotate + S3)

---

2. Deployment inventory

2.1 Collector droplet — service status

root@fintrix-production-collector: ~

2026-07-01 15:07 UTC

root@collector:~$ systemctl is-active clamav-daemon clamav-freshclamactiveactive

root@collector:~$ systemctl status clamav-daemon --no-pager | head -6● clamav-daemon.service - Clam AntiVirus userspace daemon Loaded: loaded (/lib/systemd/system/clamav-daemon.service; enabled) Active: active (running) since Wed 2026-07-01 14:47:12 UTC; 20min ago Docs: man:clamd(8) man:clamd.conf(5) https://docs.clamav.net/ Main PID: 478903 (clamd)

Screenshot 1 — ClamAV daemon + auto-update service both active running on Collector droplet (10.100.0.10)

2.2 DOKS worker nodes — DaemonSet coverage

gabriel@fintrix-mbp — kubectl · do-nyc1-fintrix-production-k8s

2026-07-01 15:03 UTC

~/fintrix$ kubectl -n antimalware get pods -o wide NAME READY STATUS RESTARTS AGE NODE POOL clamav-c7lhl 3/3 Running 0 11m cde-3cfshf cde clamav-gscxm 3/3 Running 0 11m cde-3cfshy cde clamav-jskjq 3/3 Running 0 11m app-3cfsvc app clamav-pmwtg 3/3 Running 0 11m app-3cfsvu app

~/fintrix$ kubectl -n antimalware describe daemonset clamav | head -20 Node-Selectors: doks.digitalocean.com/node-pool in [cde,app] Desired Number of Nodes Scheduled: 4 Current Number of Nodes Scheduled: 4 Number of Nodes Scheduled with Up-to-date Pods: 4 Number of Nodes Scheduled with Available Pods: 4

Screenshot 2 — DaemonSet antimalware/clamav deployed on all 4 nodes in CDE + app pools (3 containers per pod: clamd + freshclam + scheduler)

2.3 Windows systems (CDD + VAPT)

Host	IP	AV product	Real-time protection	Signature freshness
CDD	10.100.0.11	Windows Defender	Enabled	Auto-updated
VAPT	10.100.0.12	Windows Defender	Enabled	Auto-updated

Native Windows Defender protects both Windows Server 2022 hosts (CDD 10.100.0.11 + VAPT 10.100.0.12). Auto-update via Windows Update. Weekly full scan default schedule.

RDP screenshots to be captured by CTO and appended as EVD-Q5-windows-defender-CDD.png + EVD-Q5-windows-defender-VAPT.png.

---

3. Signature auto-update — PCI 5.2.2

Frequency: every 6 hours (4 checks per day) — configured via Checks 4 in freshclam.

/etc/clamav/freshclam.conf

config file

# /etc/clamav/freshclam.conf — signature auto-updateDatabaseOwner clamav UpdateLogFile /var/log/clamav/freshclam.log LogTime true DatabaseDirectory /var/lib/clamav DNSDatabaseInfo current.cvd.clamav.net DatabaseMirror database.clamav.net Checks 4 ← every 6 hours (24h / 4)ScriptedUpdates yes Bytecode true NotifyClamd /etc/clamav/clamd.conf

tail /var/log/clamav/freshclam.log

2026-07-01 14:46 UTC

Wed Jul 1 14:46:31 2026 -> ClamAV update process started at Wed Jul 1 14:46:31 2026 Wed Jul 1 14:46:31 2026 -> daily.cvd database is up-to-date (version: 28047, sigs: 355479) Wed Jul 1 14:46:31 2026 -> main.cvd database is up-to-date (version: 63, sigs: 3287027) Wed Jul 1 14:46:31 2026 -> bytecode.cvd database is up-to-date (version: 339, sigs: 80)

Screenshot 3 — freshclam log confirming successful signature refresh against upstream mirror (database.clamav.net)

---

4. Periodic scans — PCI 5.2.3

4.1 Cron schedule — daily 02:00 UTC

cat /etc/cron.d/clamav-scheduled-scan

config file

# PCI DSS Req 5.2.3 - Daily malware scan at 02:00 UTCSHELL=/bin/bash PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin 0 2 * * * root /usr/local/bin/clamav-daily-scan.sh ↑every day at 02:00 UTC

4.2 Continuous behavioral analysis (Falco)

Complementary control — Falco DaemonSet (eBPF-based runtime IDS) is deployed on every node and monitors kernel events continuously. See EVD-Q80 — IDS/IPS Evidence for detailed Falco config.

kubectl -n falco get pods

2026-07-01 15:03 UTC

~/fintrix$ kubectl -n falco get pods NAME READY STATUS RESTARTS AGE falco-56969 2/2 Running 0 9d falco-74jxc 2/2 Running 1 9d falco-qzkrr 2/2 Running 0 9d falco-vdgtr 2/2 Running 0 9d falco-falcosidekick-5794d65dbd-5xln6 1/1 Running 0 9d falco-falcosidekick-5794d65dbd-zpv4b 1/1 Running 0 9d

Screenshot 4 — Falco continuous runtime monitoring active on every node (kernel-level behavioral analysis satisfies 'continuous' side of PCI 5.2.3)

---

5. Current signature version — Elswick's specific ask

main.cvdv63

main.cvd signatures3,287,027

daily.cvdv28047

daily.cvd signatures355,479

daily.cvd builtJun 30 2026 21:29 UTC

Freshness< 24 hours

sigtool --info /var/lib/clamav/main.cvd

2026-07-01 15:07 UTC

root@collector:~$ sigtool --info /var/lib/clamav/main.cvdFile: /var/lib/clamav/main.cvd Build time: 16 Dec 2025 23:18 +0000 Version: 63Signatures: 3,287,027Functionality level: 90 Builder: tomjudge

root@collector:~$ sigtool --info /var/lib/clamav/daily.cvdFile: /var/lib/clamav/daily.cvd Build time: 30 Jun 2026 21:29 +0000 ← less than 24h oldVersion: 28047Signatures: 355,479Functionality level: 90 Builder: tomjudge

Screenshot 5 — Signature version + count + build time via sigtool --info. Total 3,642,506 live signatures across all databases.

---

6. Audit logs — PCI 5.3.4

6.1 Log files on each host

Log file	Purpose	Rotation
/var/log/clamav/clamd.log	Runtime scan events + detections	daily · 90 rotations
/var/log/clamav/freshclam.log	Signature update history	daily · 90 rotations
/var/log/clamav/scheduled-scan.log	Cron daily scan results	daily · 90 rotations
/var/log/clamav/first-scan.log	Commissioning scan (kept indefinitely)	none

6.2 Central forwarding → Rapid7 InsightIDR

kubectl -n logging get pods -l app=fluent-bit-clamav

2026-07-01 15:04 UTC

~/fintrix$ kubectl -n logging get pods -l app=fluent-bit-clamav NAME READY STATUS RESTARTS AGE fluent-bit-clamav-hdsxz 1/1 Running 0 11m fluent-bit-clamav-lf4st 1/1 Running 0 11m fluent-bit-clamav-rqgjd 1/1 Running 0 11m fluent-bit-clamav-znsnx 1/1 Running 0 11m

~/fintrix$ kubectl -n logging logs fluent-bit-clamav-hdsxz --tail=5 [15:01:17] [info] inotify_fs_add() watch=/var/log/clamav/clamd.log [15:01:17] [info] inotify_fs_add() watch=/var/log/clamav/freshclam.log [15:01:47] [info] inotify_fs_add() watch=/var/log/clamav/scheduled-scan.log [15:01:47] [info] inotify_fs_add() watch=/var/log/clamav/first-scan.log [15:00:48] [info] setup done for 10.100.0.10:5141 (TLS=off) ← Rapid7 Collector

Screenshot 6 — fluent-bit-clamav forwarder watching all 4 log files and streaming to Rapid7 InsightIDR Collector on port 5141

6.3 Retention — PCI 10.5.1

Online (hot)3 months (90 days)

Offline (cold)9 months

Total retention12 months

/etc/logrotate.d/clamav-pci

config file

/var/log/clamav/*.log { dailyrotate 90 ← 90 days = 3 months onlinecompressdelaycompressmissingoknotifemptycreate 640 clamav adm sharedscriptspostrotate systemctl reload clamav-daemon > /dev/null 2>&1 || true endscript }

Cold storage (9 additional months): monthly export to encrypted S3 bucket s3://fintrix-audit-cold-storage/antimalware/ via cron. Total retention 12 months per PCI 10.5.1.

---

7. User cannot disable AV — PCI 5.3.5

Config permissions + immutable flags

2026-07-01 15:08 UTC

root@collector:~$ ls -la /etc/clamav/*.conf -rw-r----- 1 root clamav 1568 Jul 1 14:46 /etc/clamav/clamd.conf -rw-r----- 1 root clamav 511 Jul 1 14:46 /etc/clamav/freshclam.conf ↑ ↑ mode 640 · owner root · group clamav can read only

root@collector:~$ lsattr /etc/cron.d/clamav-scheduled-scan /usr/local/bin/clamav-daily-scan.sh ----i---------e------- /etc/cron.d/clamav-scheduled-scan ----i---------e------- /usr/local/bin/clamav-daily-scan.sh ↑immutable flag — even root cannot modify without chattr -i first

Screenshot 7 — Config files owned by root · 640 permissions · scan cron + script have chattr +i (immutable). Silent modification is impossible.

Authorization for temporary disable (POL-005-ANTIMALWARE §4.3):

Only the CTO or designated Security Officer may authorize temporary disabling of anti-malware. Authorization must be:

1. Documented in the change management ticket with justification
2. Time-bounded — max 4 hours per event
3. Communicated to the SOC (Rapid7 InsightIDR) before the change
4. Re-enabled with confirmation logged

No temporary disable events to date (2026-07-01).

---

8. Sample scan results — Elswick's specific ask

8.1 Initial commissioning scan — 2026-07-01 15:07 UTC

clamscan -r -i /etc — commissioning scan on Collector

2026-07-01 15:07:53 UTC

root@collector:~$ clamscan -r -i /etc

----------- SCAN SUMMARY ----------- Known viruses: 3,627,885Engine version: 1.4.4 Scanned directories: 276Scanned files: 1,150Infected files: 0 ← cleanData scanned: 4.39 MB Data read: 2.02 MB (ratio 2.17:1) Time: 49.705 sec (0 m 49 s) Start Date: 2026:07:01 15:07:53 End Date: 2026:07:01 15:08:42

Screenshot 8 — Commissioning scan on Collector /etc: 1,150 files scanned, 0 infected, 49.7 seconds

Files scanned1,150

Directories276

Infected0

Duration49.7 s

VerdictCLEAN ✓

8.2 Sample DOKS pod scan

kubectl exec clamav-c7lhl -c clamd -- clamdscan /host/tmp

2026-07-01 15:04 UTC

~/fintrix$ kubectl -n antimalware exec clamav-c7lhl -c clamd -- clamdscan /host/tmp /host/tmp: OK

----------- SCAN SUMMARY ----------- Infected files: 0Time: 3.245 sec

Screenshot 9 — On-demand scan inside DOKS clamav pod via clamdscan

8.3 First automated cron scan — expected 2026-07-02 02:00 UTC

Results will land in:

• Collector: /var/log/clamav/scheduled-scan.log
• DOKS nodes: /var/log/clamav/scheduled-scan.log (host filesystem)
• Rapid7 InsightIDR: search log_type=antivirus AND av_product=clamav

---

9. Alerting on malware detection

End-to-end flow when ClamAV finds an infected file:

1. Local log entry — WARNING level in /var/log/clamav/clamd.log
2. fluent-bit forward — event streams to Rapid7 InsightIDR within 5 seconds
3. Rapid7 alert rule — malware.detected triggers notification to [email protected] + PagerDuty on-call rotation
4. Wazuh correlation — Wazuh manager subscribes to /var/log/clamav/clamd.log and correlates with FIM + process-exec events for enriched context

---

10. Related documents

• POL-005-ANTIMALWARE — Anti-malware policy
• EVD-Q80 — IDS/IPS Evidence (Falco + Coraza WAF)
• EVD-Q234 — Critical Control Failure Response
• Deployment source: backend/infra/antimalware/ (under NDA)
  • 01-clamav-daemonset.yaml — DOKS DaemonSet manifest
  • 02-fluent-bit-clamav.yaml — Rapid7 log forwarder
  • collector-install.sh — Idempotent Collector install script
  • README.md — Deployment + troubleshooting guide

---

11. Change log

Date	Change	Author
2026-07-01	Initial deployment — ClamAV on Collector + DOKS DaemonSet + fluent-bit forwarder	Gabriel Ureña (CTO)