Hello everyone - I’m John Spinks, member of
the Insights product team. Today we’re going to take a look
at the Malware Detection service within Red Hat Insights.
As a reminder Insights is included with existing
subscriptions for Red Hat Ansible Automation Platform,
Red Hat Enterprise Linux, and Red Hat OpenShift.
The malware-detection service is a monitoring and assessment
tool that scans Red Hat Enterprise Linux systems for the presence
of malware. The malware-detection service
incorporates YARA pattern-matching software and
malware-detection signatures. Signatures
are provided in partnership with the IBM X-Force threat intelligence
team working closely with the Red Hat security team.
In order to use the Malware
detection service there are a few things that you need to do.
As mentioned, Malware detection leverages YARA pattern matching.
You will need to install the Yara package on each host
that you want to scan for malware - this package is included in the
appstream repository for RHEL 8 and 9.
Once Yara is installed you will need to
run a malware detection scan. You will want to schedule future scans
using cron or Ansible automation. When a scan is
performed, Insights uses the signatures from IBM X-Force
threat intelligence to help identify the presence of malware.
You will also need to make sure that your user has the appropriate permissions on the Hybrid Cloud Console
to use the Malware Detection service.
Due to the sensitive nature of this and other security services, only
organization administrators have access to Malware Detection by default.
Other users must be explicitly granted the Malware Detection Viewer
or Administrator role. In my environment
I have already installed yara, scheduled a daily scan to run,
and made sure that I have the appropriate permissions.
I have also simulated a malware signature on some of my hosts.
Let's look to see how Insights shows us the detection of Malware.
There are lots of different ways
you can be notified of issues that Insights detects. As one
example, I have configured Insights to send notifications to a slack channel.
You can see here that one of my hosts is reporting that malware has been detected.
If I click on the alert it will redirect me
to the Malware service inside of Insights.
Here in the Hybrid Cloud Console
you can see that the Malware detection service has found active, or in my
case simulated, malware matching 3 different malware
signatures across 13 different systems
that are currently under evaluation. I can also see that at this
point I am evaluating against 225 signatures.
As the IBM X-Force threat intelligence
team releases new signatures, they will automatically be added
to Insights. I’m going to click on
“3 matched signatures” to filter my view to only show me the matches.
It looks like I have detected the FinSpy
and two different Linux Generic Backdoor malware signatures.
To get more details about the FinSpy malware, I’ll click on it.
This page gives me a small description of the malware,
how many systems have matched with this signature,
and the last time it was matched. In this case
the malware was detected on dur-rhc05.
I can expand out the host to see details of the matching signature.
I can also copy or download this information for sharing with my security team.
I should repeat this with any other systems
where malware was detected and report this information to my security team
immediately. Unlike other Insights services,
The malware-detection service does not recommend resolutions to resolve
or remediate malware incidents.
The strategy to take in addressing a malware threat depends on a lot of criteria
and considerations specific to each system and organization.
Your organization’s security incident response team is
best qualified to design and implement an effective mitigation
and remediation strategy for each circumstance.
This completes this look at the Malware Detection service.
As a reminder, Red Hat Insights has services available for
Red Hat Enterprise Linux, Red Hat OpenShift, and Red Hat
Ansible Automation Platform. This value is included within
your existing subscriptions, so there is nothing more to buy - just start using it.
Thanks for your time, and I hope you enjoyed
this look at detecting Malware with Red Hat Insights.