Test agentless malware scanning alerts

In addition to the next-generation antimalware protection provided by agent-based Defender for Endpoint integration with Defender for Cloud, Defender for Servers Plan 2 provides agentless malware scanning as part of its agentless scanning capabilities.

This article describes how to create a test alert to make sure that agentless malware scanning is working as expected.

Prerequisites

• Defender for Servers Plan 2 is turned on.
• Agentless scanning is enabled in the plan.

Create a test file for Linux

Use the following steps to create a test file on a Linux VM and trigger an agentless malware scanning alert.

1. Open a terminal window on the VM.

2. Run the following script to create and validate a test file that contains the antivirus test string:

   # test string  
   TEST_STRING='$$89-barbados-dublin-damascus-notice-pulled-natural-31$$'  
   
   # File to be created  
   FILE_PATH="/tmp/virus_test_file.txt"  
   
   # Write the test string to the file  
   echo -n $TEST_STRING > $FILE_PATH  
   
   # Check if the file was created and contains the correct string  
   if [ -f "$FILE_PATH" ]; then  
       if grep -Fq "$TEST_STRING" "$FILE_PATH"; then  
           echo "Virus test file created and validated successfully."  
       else  
           echo "Virus test file does not contain the correct string."  
       fi  
   else  
       echo "Failed to create virus test file."  
   fi
   

The alert MDC_Test_File malware was detected (Agentless) will appear within 24 hours in the Defender for Cloud Alerts page and in the Defender XDR portal.

Create a test file for Windows with a text document

Use the following steps to create a Windows text file that triggers a test alert for agentless malware scanning.

1. Create a text file on your VM.

2. Paste the text $$89-barbados-dublin-damascus-notice-pulled-natural-31$$ into the text file. Ensure that there are no extra spaces or lines in the text file.

3. Save the file.

4. Open the file to validate that it contains the pasted test string.

The alert MDC_Test_File malware was detected (Agentless) will appear within 24 hours in the Defender for Cloud Alerts page and in the Defender XDR portal.

Create a test file for Windows with PowerShell

Use the following PowerShell steps to create a Windows test file and generate a malware scanning test alert.

1. Open PowerShell on your VM.

2. Execute the following script.

# Virus test string
$TEST_STRING = '$$89-barbados-dublin-damascus-notice-pulled-natural-31$$'

# File to be created
$FILE_PATH = "C:\temp\virus_test_file.txt"

# Create "temp" directory if it does not exist
$DIR_PATH = "C:\temp"
if (!(Test-Path -Path $DIR_PATH)) {
   New-Item -ItemType Directory -Path $DIR_PATH
}

# Write the test string to the file without a trailing newline
[IO.File]::WriteAllText($FILE_PATH, $TEST_STRING)

# Check if the file was created and contains the correct string
if (Test-Path -Path $FILE_PATH) {
    $content = [IO.File]::ReadAllText($FILE_PATH)
    if ($content -eq $TEST_STRING) {
      Write-Host "Test file created and validated successfully."
    } else {
       Write-Host "Test file does not contain the correct string."
    }
} else {
    Write-Host "Failed to create test file."
}

The alert MDC_Test_File malware was detected (Agentless) will appear within 24 hours in the Defender for Cloud Alerts page and in the Defender XDR portal.