Lion Cipher Lab
Set up on-demand and on-access antivirus scanning with ClamAV
- Cyber / Security Engineer
- Intermediate
- ~40 min
- Free · no account required
Why it matters
Signature antivirus is one of the oldest and most boring controls in security — and it's still a baseline every defended machine should have, because it reliably and cheaply catches the enormous long tail of KNOWN malware. ClamAV is the standard open-source AV engine: it's free, it runs everywhere Linux does, and it's the workhorse behind mail-server and file-share scanning across the internet. Learning it teaches the real anatomy of an antivirus — a scanner, a resident daemon, an on-access hook, and a signature updater that has to keep running or the whole thing rots. Just as important,…
What you'll learn
- installing and configuring ClamAV on Linux
- updating signature databases with freshclam
- on-demand scanning with clamscan
- safely testing detection with the EICAR test file
- on-access real-time scanning with clamd and clamonacc
- understanding the limits of signature antivirus vs behavioural/EDR
Steps in this lab
- The pieces of ClamAV, before you touch anything
- Install ClamAV
- Update the signatures with freshclam — and understand why
- Run your first on-demand scan with clamscan
- Prove detection safely with the EICAR test file
- Bring up the daemon (clamd) and confirm it's running
- Turn on on-access scanning with clamonacc and catch a file in real time
- When, why, and what's better — the honest limits