Much of the security industry is pretty down on anti-virus, and for good reason: it’s not very effective at blocking many malware infections. When installed, it is a tool in the toolbox, though, and can be quite valuable. One major problem with AV is that it’s not always great tool to monitor because if it can detect malware, it can probably block it. As with many things, the context is important, though.
For example, if your AV product detects and blocks an attempted infection on a workstation, that might be interesting, but likely will not result in any kind of investigation, leading one to question why AV logs should be monitored. But if that detection happens as the result of a full scan, depending on what was detected and where it was detected, some investigation to find out what happened or wipe/reinstall the system is likely in order.
The story is a bit different on servers: if a server’s AV detects malware, regardless of when the malware was detected, investigation is likely warranted, since servers should generally not encounter malware, and if they do, something is wrong in the environment and should be investigated. File servers are different still, since endpoints can and will copy malware laden files onto a file server, and that does not indicate that the file server itself is “under attack”, however such events should still be investigated to find and address the culprit.
I once worked on an incident where a web server was compromised. In the analysis, we could see an adversary found a file upload and separate local file inclusion vulnerability in the web application on the server. Upon inspecting the AV engine, we found that the AV engine dutifully detected and quarantined various versions of a web shell the adversary was uploading for several days. Eventually, the adversary found a web shell that the AV engine didn’t detect, and the rest is history.
In summary, collect your AV logs and apply some form of analysis on them. AV is far from perfect, but it does work at times, and we should pay attention when it does.