Ansible Ecomscan Role
Ansible role for either triggering ondemand Sansec Malware scans or configuring scheduled scanning across an entire fleet of distributed infrastructure
Ansible role for configuring and triggering Sansec Malware scanning across a large fleet of infrastructure, spanning multiple platforms and hosting vendors. With scheduled scanning reporting to a centralized dashboard with Email/Webhook notifications.
Ecommerce platforms include: Magento, WooCommerce and Shopware. And hosting from a wide range of providers, where SSH write access is available.
Problem
Manually configuring and maintaining Ecomscan installations wasn’t sustainable, and came with a large maintenance burden and time sink, especially when onboarding / offboarding projects.
This Ansible role, allows for a central playbook to be created and managed as an authoritve source.
Manual security scanning across dozens of client sites wasn’t sustainable, and commercial solutions were prohibitively expensive for SMB clients. Multiple security incidents occurred where early detection could have prevented customer data exposure, particularly during CosmicSting and SessionReaper campaigns.
Solution
Multi-Platform Detection:
- Malware signatures and backdoor detection
- File integrity monitoring for unauthorized changes
- Known vulnerability patterns for common exploits
- Suspicious code pattern matching (encoded/obfuscated)
- Modified core files and suspicious permissions
Platform Support:
- Magento 2 (deep scanning of modules/themes)
- WooCommerce (WordPress core and plugins)
- Shopware (platform-specific checks)
- Generic PHP (adaptable to other platforms)
Automation & Monitoring:
- Scheduled scans (daily quick, weekly deep)
- Parallel execution across multiple sites
- Slack/Discord/Email notifications
- Centralized logging and Grafana dashboards
- Historical comparison to detect new threats
Impact
- Identified compromised sites before customer impact
- Automated monitoring across dozens of client stores
- Early detection of CosmicSting and SessionReaper exploits
- Cost-effective alternative to expensive commercial tools
Technical Highlights
- Low resource impact suitable for production
- Incremental scanning (only changed files)
- Off-peak scheduling options
- Easy deployment via Ansible role