Endpoint Protection Auditor

The problem

3.14.2 has no waiver path. Malicious code protection at appropriate locations is required. Yet contractors routinely have endpoints with the AV agent installed but real-time protection disabled, definitions a week out of date, or tamper protection off, meaning malware can disable the agent during execution and the contractor never knows.

Exclusions are the contractor-side failure mode that matters most. Malware family operators routinely instruct victims to add exclusions before payload deployment, and an exclusion of C:\Users\, %TEMP%, or .ps1 effectively turns off the AV product for the locations attackers actually use. These are configuration findings, not detection failures, and the assessor will read the exclusion list line by line.

EDR products differ from traditional AV in checkable ways: cloud-delivered content updates instead of signature files, agent versions to track against vendor minimums, last-heartbeat timestamps showing whether the agent is still talking to its console. The audit needs to cover both classes correctly without false positives on Linux for Windows-only concepts and without missing tamper-protection regressions on EDR.

What CMMC requires

NIST SP 800-171 Rev 2 controls this agent verifies. Primary mappings drive the gap assessment; secondary mappings provide supporting evidence in the SSP.

How it works

Per-platform detection logic. The agent runs unprivileged where possible and falls back gracefully when raw access is unavailable.

What it finds

Concrete findings written to the assessor's mental model,not abstract categories. Severity drives POA&M priority and SPRS deduction.

• CRITICAL
  No AV/EDR detected

  No malicious code protection of any kind is running. 3.14.2 has no waiver,this is a direct compliance failure.
• CRITICAL
  Real-time protection disabled

  Defender DisableRealtimeMonitoring=1 or ClamAV clamonacc not running. The product is installed but not actively scanning.
• CRITICAL
  Defender exclusion includes C:\ or C:\Users\

  Root-path exclusion effectively disables AV across the entire system. Common malware-instructed configuration change.
• HIGH
  Definitions older than 7 days

  Last signature update is more than 7 days ago. Recent threats are not detected. 3.14.4 update-mechanism failure.
• HIGH
  Tamper protection disabled

  Defender Features\TamperProtection ≠ 5 or EDR equivalent off. Malware can disable the agent at runtime,defeats the agent's own enforcement.
• HIGH
  Script extension excluded (.ps1, .vbs, .js)

  Exclusion list includes script extensions commonly used as malware delivery. Living-off-the-land attacks bypass scanning entirely.
• HIGH
  /etc/ld.so.preload non-empty

  LD_PRELOAD-based rootkit indicator. Investigate immediately,preloaded shared libraries on Linux are a primary persistence mechanism.

How it hooks into the platform

The platform identifies the AV/EDR on each host during auto-discovery and runs the audit on its own schedule. You configure whether the product inventory and exclusion list stay on-prem or sync up. Detected products draft the SSP's 3.14.2 narrative as an inventory table covering product, version, real-time state, last update, and tamper protection. The exclusion list always exports for manual review even when no findings open, because the assessor will ask. POA&M items reference specific exclusions or definition versions; new exclusions or agent disconnection alert between scans.

How we know it's working

Acceptance criteria from the engineering spec,what the agent must do to ship.

• ✓Detects Defender, Falcon, SentinelOne, Carbon Black, and ClamAV per host
• ✓Reads Defender real-time state from registry directly, not from manipulable WMI
• ✓Computes definition age for both signature and cloud-delivered products
• ✓Always returns the full exclusion list in structured output for review
• ✓Parses rkhunter logs in both compressed and plaintext form
• ✓Inspects /etc/ld.so.preload unprivileged for rootkit indicators
• ✓Suppresses Windows-only checks on Linux and macOS, no false positives