Container runtime antimalware detection and blocking

@@ -1,8 +1,9 @@ --- title: Container runtime antimalware detection and blocking description: Learn how to configure container runtime antimalware detection and blocking to block or alert on malware in Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP) environments.+ms.custom: msecd-doc-authoring-1013 #customer intent: As a security admin, I want to configure container runtime antimalware policies so that I can detect and prevent malware in my containerized workloads.-ms.date: 05/25/2026+ms.date: 07/27/2026 ms.topic: how-to ai-usage: ai-assisted ---@@ -19,54 +20,129 @@ Container runtime antimalware detection and blocking is part of the Defender for  ## Prerequisites -- To use container runtime antimalware detection and blocking, you need to run the Defender for Containers sensor, which is available for Amazon Web Services (AWS), Google Cloud Platform (GCP), and Azure Kubernetes Service (AKS) clouds. This feature is supported for:-    - **AKS**: Helm provisioning with sensor version **0.10.X GA latest version**.-    - **Multicloud**: -        - Enable Azure Arc (ARC) auto-provisioning on the enablement page.--            :::image type="content" source="media/anti-malware/enable-toggles.png" alt-text="Screenshot that shows the enablement toggles for ARC." lightbox="media/anti-malware/enable-toggles.png":::--        - Helm provisioning with sensor version **0.10.X GA latest version** or the ARC extension, with the command -          `--configuration-settings collectors.antimalwareCollector.enable='true'`.-    -            For example:-        -            ```azurecli    -            az k8s-extension create --name  microsoft.azuredefender.kubernetes --extension-type  microsoft.azuredefender.kubernetes --cluster-name <name> --resource-group <rg> --cluster-type connectedClusters --configuration-settings collectors.antimalwareCollector.enable='true'-            ```-    -- You must enable the Defender for Containers sensor on the subscriptions and connectors.--- To create and modify antimalware policies, you need Security Admin or higher permissions on the tenant. To view antimalware policies, you need Security Reader or higher permissions on the tenant. --- In addition to the [core sensor memory and central processing unit (CPU) requirements](/azure/defender-for-cloud/defender-for-containers-architecture?tabs=defender-for-container-arch-aks#defender-sensor-component-details), you need:-  -    | Component | Request | Limit |-    |--|--|--|-    | CPU | 50 m | 300 m |-    | Memory | 128Mi | 500Mi |+- [Defender for Containers enabled on your subscription](defender-for-containers-enable-plan.md).+  - Enable the Defender for Containers sensor on the subscriptions and connectors.+- To create and modify antimalware policies, you need Security Admin or higher permissions on the tenant. To view antimalware policies, you need Security Reader or higher permissions on the tenant.+- In addition to the core sensor memory and central processing unit (CPU) requirements, you need:++  | Component | Request | Limit |+  | --- | --- | --- |+  | CPU | 50 m | 300 m |+  | Memory | 128Mi | 500Mi |  Learn more about [antimalware detection and blocking availability](support-matrix-defender-for-containers.md#runtime-protection-features). -### Components+## Components -The following components are part of antimalware detection and blocking: +The following components are part of antimalware detection and blocking:  - An enhanced sensor that detects and prevents malware.- - Antimalware policy configuration options.- - Antimalware alerts.  ## Enable antimalware detection and blocking -Antimalware isn't enabled by default because it uses extra cluster resources.+Antimalware isn't enabled by default because it uses extra cluster resources. Use one of the following methods based on your cluster platform.++### Azure Kubernetes Service (AKS)++You can enable the antimalware collector using one of the following methods:++#### [Auto-provisioning (recommended)](#tab/aks-auto-provisioning)++In the Defender sensor configuration, turn on **Enable Defender Runtime Anti Malware**.++:::image type="content" source="media/anti-malware/enable-defender-runtime-antimalware.png" alt-text="Screenshot of the Defender sensor configuration with Defender Runtime Anti Malware enabled." lightbox="media/anti-malware/enable-defender-runtime-antimalware.png":::++#### [Helm](#tab/aks-helm)++Deploy sensor version 0.10.x or later by following the instructions to [install the Defender for Containers sensor by using Helm](deploy-helm.md). During installation, include the following setting:++```bash+--set microsoft-defender-for-containers-sensor.antimalwareCollector.enabled=true+```++#### [AKS preview API](#tab/aks-preview-api)++You can manually enable the antimalware collector by updating the AKS security profile.++**Get the current state**++```powershell+az rest --method GET `+  --url "https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroup}/providers/Microsoft.ContainerService/managedClusters/{clusterName}?api-version=2026-03-02-preview" `+  --query "properties.securityProfile.defender" `+  --output json+```++**Enable antimalware**++Use the existing Defender configuration returned by the GET request to create a JSON file named `enable-am.json`. Preserve the existing properties under `defender`, and add the `antimalware` configuration:++```json+{+  "location": "<cluster-location>",+  "properties": {+    "securityProfile": {+      "defender": {+        "antimalware": {+          "enabled": true+        },+        "logAnalyticsWorkspaceResourceId": "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroup}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}",+        "securityMonitoring": {+          "enabled": true+        }+      }+    }+  }+}+``` -To install the sensor with antimalware enabled, follow the instructions to [install Defender for Containers sensor by using Helm](deploy-helm.md) and include the `--antimalware` flag.+```powershell+az rest --method PUT `+  --url "https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroup}/providers/Microsoft.ContainerService/managedClusters/{clusterName}?api-version=2026-03-02-preview" `+  --body "@enable-am.json"+```++---++### Amazon EKS and Google GKE++For connected multicloud clusters, you can enable the antimalware collector using one of the following methods:++#### [Azure Arc auto-provisioning (recommended)](#tab/multicloud-auto-provisioning)++On the enablement page, turn on **Auto provision Defender's sensor for Azure Arc** and **Enable Defender Anti-Malware**.++:::image type="content" source="media/anti-malware/enable-defender-antimalware-arc.png" alt-text="Screenshot of the Defender for Containers enablement settings with Defender sensor auto-provisioning for Azure Arc and Defender Anti-Malware enabled." lightbox="media/anti-malware/enable-defender-antimalware-arc.png":::++#### [Azure Arc extension](#tab/multicloud-arc-extension)++Deploy the Defender for Containers Azure Arc extension with the antimalware collector enabled.++```azurecli+az k8s-extension create \+  --name microsoft.azuredefender.kubernetes \+  --extension-type microsoft.azuredefender.kubernetes \+  --cluster-name <cluster-name> \+  --resource-group <resource-group> \+  --cluster-type connectedClusters \+  --configuration-settings antimalwareCollector.enabled='true'+```++#### [Helm](#tab/multicloud-helm)++Deploy sensor version 0.10.x or later by following the instructions to [install the Defender for Containers sensor by using Helm](deploy-helm.md). During installation, include the following setting:++```bash+--set microsoft-defender-for-containers-sensor.antimalwareCollector.enabled=true+```++---  ## Add antimalware rules -When you install the sensor with antimalware enabled, it configures three antimalware rules by default. These rules include: +When you install the sensor with antimalware enabled, it configures three antimalware rules by default. These rules include:  - `Malware alert on binaries not originated from original image`: a suggested rule for situations where the system detects a drifted binary. - `Default antimalware workload rule`.@@ -74,7 +150,7 @@ When you install the sensor with antimalware enabled, it configures three antima  The two default antimalware rules (workload and host) apply to every potential situation if no other rule matches first. You can only modify the default rules' actions and set them to alert, block, or ignore. -You can create new antimalware rules to define when alerts should be generated, blocked, or ignored. Each rule can define the conditions for generating alerts. This structure allows you to tailor the system to your specific needs and reduce false positives. You can create exclusions by setting higher priority rules for specific scopes or clusters, images, pods, Kubernetes labels, or namespaces. +You can create new antimalware rules to specify whether detected malware is ignored, generates an alert, or is blocked. Each rule can define the conditions for generating alerts. This structure allows you to tailor the system to your specific needs and reduce false positives. You can create exclusions by configuring higher-priority rules for specific scopes, clusters, images, pods, Kubernetes labels, or namespaces.  1. Sign in to the [Azure portal](https://portal.azure.com/). @@ -84,30 +160,30 @@ You can create new antimalware rules to define when alerts should be generated      :::image type="content" source="media/anti-malware/alert-on-malware-rule-screen.png" alt-text="Screenshot of Microsoft Defender for Cloud showing the anti-malware policy page with three rules: Alert on Malware, Default for workload, and Default for host." lightbox="media/anti-malware/alert-on-malware-rule-screen.png"::: -1.  Select **Antimalware** > **+ Add rule**. +1. Select **Antimalware** > **+ Add rule**.       :::image type="content" source="media/anti-malware/configure-new-rule-screen.png" alt-text="Screenshot of the Add Rule side panel showing fields for rule name, conditions, and actions with options to alert, block, or ignore." lightbox="media/anti-malware/configure-new-rule-screen.png"::: -1.  Enter a rule name.+1. Enter a rule name.   1. Select an available action:-    - **Ignore Malware**: Ignore the selected malware.-    - **Alert on Malware**:  Generate an alert. For example, if a rule detects a drifted binary.-    - **Block Malware**: Block the malware from running.+    - **Ignore Malware:** Ignore the selected malware.+    - **Alert on Malware:** Generate an alert when malware is detected, such as when a rule detects a drifted binary.+    - **Block Malware:** Block the malware from running.  1. Enter a scope name. -1. Select a cloud scope and (optional) specific subscription.+1. Select a cloud scope and, if needed, a specific subscription. -1. (Optional) Select a resource scope.+1. If needed, select a resource scope. -1. (Optional) Add conditions to the resource scope based on the following categories: **Container name**, **Image name**, **Namespace**, **Pod labels**, **Pod name**, or **Cluster name**. Then choose an operator: **Starts with**, **Ends with**, **Equals**, or **Contains**. Finally, enter the value to match. You can add as many conditions as needed by selecting **+Add condition**.+1. If needed, add conditions to the resource scope based on the following categories: **Container name**, **Image name**, **Namespace**, **Pod labels**, **Pod name**, or **Cluster name**. Then choose an operator: **Starts with**, **Ends with**, **Equals**, or **Contains**. Finally, enter the value to match. You can add as many conditions as needed by selecting **+Add condition**. -1. (Optional) Select the checkbox to exclude binaries from container image.+1. If needed, select the checkbox to exclude binaries from container image. -1. (Optional) Add **Allow list for processes**, a list of processes that are allowed to run in the container. If a process isn't on this list, an alert is generated. +1. If needed, add an **Allow list for processes** to specify the processes that are allowed to run in the container. If a process isn't on the list, an alert is generated. -1.  Select **Apply**.+1. Select **Apply**.  1. Select **Save**. @@ -115,11 +191,11 @@ After 30 minutes, the sensors on the protected clusters are updated with the new  ## Manage antimalware rules -Based on the alerts, you receive and review, you might need to adjust the rules in the antimalware policy. This adjustment might include refining conditions, adding rules, or removing rules that generate many false positives. The goal is to balance security needs with operational efficiency by using effective antimalware policies and rules.+Based on the alerts you receive and review, you might need to adjust the rules in the antimalware policy. These adjustments might include refining conditions, adding rules, or removing rules that generate many false positives. The goal is to balance security needs with operational efficiency by using effective antimalware policies and rules.  Effective antimalware detection relies on your active role in configuring, monitoring, and adjusting policies for your environment. -You can arrange rules by priority by selecting the up or down arrow. The rule with the highest priority (the lowest number) runs first. If a rule matches, the rule action runs and the evaluation ends. If no match, the system evaluates the next rule. If no rule matches, the system applies the default rules.+You can arrange rules by priority by selecting the up or down arrow. The rule with the highest priority (the lowest number) runs first. If a rule matches, the rule action runs and the evaluation ends. If a rule doesn't match, the system evaluates the next rule. If no rule matches, the system applies the default rules.  You can manage each rule by using the toolbar controls. @@ -134,6 +210,4 @@ After you configure your rules, select **Save** to apply the changes and create ## Next step  > [!div class="nextstepaction"]-> [Overview of Container security in Microsoft Defender for Containers](/azure/defender-for-cloud/defender-for-containers-introduction)--+> [Overview of Container security in Microsoft Defender for Containers](/azure/defender-for-cloud/defender-for-containers-introduction)\ No newline at end of file