Virtual Machine should have antimalware extension installed

High Azure General vm-virtual-machine-antimalware-extension

Anti-malware protection helps identify and remove viruses, spyware, and other malicious software

Applies to

Microsoft.Compute/virtualMachines

What CGPulse checks

A resource passes this rule when extensions.hasAntimalware must equal true. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Install anti-malware protection to defend against viruses and ransomware. In Azure Portal: VM > Extensions > Add > select Microsoft Antimalware. See: https://learn.microsoft.com/en-us/azure/virtual-machines/extensions/iaas-antimalware-windows

CLI

az vm extension set -g "{rg}" --vm-name "{name}" --name IaaSAntimalware --publisher Microsoft.Azure.Security --version "1.*"

Terraform

resource "azurerm_virtual_machine_extension" "antimalware" {
  name                       = "IaaSAntimalware"
  virtual_machine_id         = "{id}"
  publisher                  = "Microsoft.Azure.Security"
  type                       = "IaaSAntimalware"
  type_handler_version       = "1.3"
  auto_upgrade_minor_version = true
  settings = jsonencode({
    AntimalwareEnabled          = true
    RealtimeProtectionEnabled   = "true"
    ScheduledScanSettings = {
      isEnabled = "true"
      scanType  = "Quick"
      day       = "7"
      time      = "120"
    }
  })
  # Windows only — for Linux VMs, use Microsoft Defender for Endpoint (MDE)
}

Compliance frameworks

Cloud Security BaselineES-2

Vendor documentation

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan