Merge pull request #2171 from ElazarK/WI444612-antimalware

Wi444612 antimalware

Author: Stacyrch140

articles/defender-for-cloud/TOC.yml

@@ -806,8 +806,11 @@
             href: transition-to-defender-vulnerability-management.md
           - name: Common questions 
             href: common-questions-microsoft-defender-vulnerability-management.md
-      - name: Binary drift detection
-        displayName: k8s, containers, aks
+      - name: Antimalware
+        displayName: antimalware, containers,
+        href: anti-malware.md
+      - name: Binary drift detection and blocking
+        displayName: k8s, containers, aks, block, binary, drift, detection, blocking
         href: binary-drift-detection.md
       - name: Kubernetes data plane hardening
         displayName: k8s, containers, aks

articles/defender-for-cloud/anti-malware.md

@@ -0,0 +1,132 @@
+---
+title: Anti-malware detection and blocking
+description: Learn how to configure Container runtime anti-malware detection and blocking to block or alert on malware in Azure, Amazon Web Service (AWS), and Google Cloud Project (GCP) environments.
+#customer intent: As a security admin, I want to configure container runtime antimalware policies so that I can detect and prevent malware in my containerized workloads.
+author: ElazarK
+ms.author: elkrieger
+ms.date: 02/22/2026
+ms.topic: how-to
+---
+
+# Anti-malware detection and blocking
+
+Container runtime anti-malware detects and blocks malware when a container runs an executable that the system identifies as malicious software.
+
+This feature sends alerts when it identifies malware and lets you block malware.  
+
+You can define anti-malware policies that set conditions for alerts and blocking. These policies help you distinguish legitimate activity from potential threats.
+
+Container runtime anti-malware detection and blocking is part of the Defender for Containers plan. This feature is available for Azure Kubernetes Service (AKS), Amazon Elastic Kubernetes Service (EKS), and Google Kubernetes Engine (GKE).
+
+## Prerequisites
+
+- To use container runtime anti-malware detection and blocking, you need to run the Defender for Container sensor, which is available for the AWS, GCP, and AKS clouds. Currently, this feature is in preview and is only supported for:
+    - **AKS**: Helm provisioning with sensor version **0.10.2**.
+    - **Multicloud**: Helm provisioning with sensor version **0.10.2** or the ARC extension using `release-train=preview`, with the command `--configuration-settings collectors.antimalwareCollector.enable='true`.
+
+    For example:
+
+    ```azurecli    
+    az k8s-extension create --name  microsoft.azuredefender.kubernetes --extension-type  microsoft.azuredefender.kubernetes --cluster-name <name> --resource-group <rg> --cluster-type connectedClusters --release-train preview --configuration-settings collectors.antimalwareCollector.enable='true'
+    ```
+    
+- You must enable the Defender for Container sensor on the subscriptions and connectors. 
+
+- To create and modify anti-malware policies, you need Security Admin or higher permissions on the tenant. To view anti-malware policies, you need Security Reader or higher permissions on the tenant. 
+
+- In addition to the [core sensor memory and CPU requirements](/azure/defender-for-cloud/defender-for-containers-architecture?tabs=defender-for-container-arch-aks#defender-sensor-component-details), you need:    
+  
+    | Component | Request | Limit |
+    |--|--|--|
+    | CPU | 50 m | 300 m |
+    | Memory | 128Mi | 500Mi |
+
+Learn more about [anti-malware detection and blocking availability](support-matrix-defender-for-containers.md#runtime-protection-features).
+
+### Components
+
+The following components are part of anti-malware detection and blocking: 
+
+- An enhanced sensor that detects and prevents malware.
+
+- Anti-malware policy configuration options.
+
+- Anti-malware alerts.
+
+## Enable anti-malware detection and blocking
+
+Anti-malware isn't enabled by default because it consumes extra cluster resources.
+
+To install the sensor with anti-malware enabled, follow the instructions to [install Defender for Containers sensor by using Helm](deploy-helm.md) and include the `--antimalware` flag.
+
+## Add anti-malware rules
+
+When you install the sensor with anti-malware enabled, it configures three anti-malware rules by default. These rules include: 
+
+- `Malware alert on binaries not originated from original image`: a suggested rule for situations where the system detects a drifted binary.
+- `Default antimalware workload rule`.
+- `Default anitmalware host rule`.
+
+The two default anti-malware rules (workload and host) apply to every potential situation if no other rule matches first. You can only modify the default rule's actions and set it to alert, block, or ignore.  
+
+You can create new anti-malware rules to define when alerts should be generated, blocked, or ignored. Each rule can define the conditions for generating alerts. This structure allows you to tailor the system to your specific needs and reduce false positives. You can create exclusions by setting higher priority rules for specific scopes or clusters, images, pods, Kubernetes labels, or namespaces. 
+
+1. Sign in to the [Azure portal](https://portal.azure.com/).
+
+1. Go to **Defender for Cloud** > **Environment settings**.
+
+1. Select **Security rules**. 
+
+    :::image type="content" source="media/anti-malware/alert-on-malware-rule-screen.png" alt-text="Screenshot of Microsoft Defender for Cloud showing the anti-malware policy page with three rules: Alert on Malware, Default for workload, and Default for host." lightbox="media/anti-malware/alert-on-malware-rule-screen.png":::
+
+1.  Select **Antimalware** > **+ Add rule**. 
+
+    :::image type="content" source="media/anti-malware/configure-new-rule-screen.png" alt-text="Screenshot of the Add Rule side panel showing fields for rule name, conditions, and actions with options to alert, block, or ignore." lightbox="media/anti-malware/configure-new-rule-screen.png":::
+
+1.  Enter a rule name.
+ 
+1. Select an available action:
+    - **Ignore Malware**: Ignore the selected malware.
+    - **Alert on Malware**:  Generate an alert. For example, if a rule detects a drifted binary.
+    - **Block Malware**: Block the malware from running.
+
+1. Enter a scope name.
+
+1. Select a cloud scope and (optional) specific subscription.
+
+1. (Optional) Select a resource scope.
+
+1. (Optional) Add conditions to the resource scope based on the following categories: **Container name**, **Image name**, **Namespace**, **Pod labels**, **Pod name**, or **Cluster name**. Then choose an operator: **Starts with**, **Ends with**, **Equals**, or **Contains**. Finally, enter the value to match. You can add as many conditions as needed by selecting **+Add condition**.
+
+1. (Optional) Select the checkbox to exclude binaries from container image.
+
+1. (Optional) Add **Allow list for processes**, a list of processes that are allowed to run in the container. If a process isn't on this list, an alert is generated. 
+
+1.  Select **Apply**.
+
+1. Select **Save**.
+
+After 30 minutes, the sensors on the protected clusters are updated with the new rule.
+
+## Manage anti-malware rules
+
+Based on the alerts, you receive and review, you might need to adjust the rules in the anti-malware policy. This adjustment might include refining conditions, adding rules, or removing rules that generate many false positives. The goal is to balance security needs with operational efficiency by using effective anti-malware policies and rules.
+
+Effective anti-malware detection relies on your active role in configuring, monitoring, and adjusting policies for your environment.
+
+You can arrange rules by priority by selecting the up or down arrow. The rule with the highest priority (the lowest number) runs first. If a rule matches, the rule action runs and the evaluation ends. If no rule matches, the system evaluates the next rule. If no rule matches, the system applies the default rules.
+
+You can manage each rule by using the toolbar controls.
+
+:::image type="content" source="media/anti-malware/rule-toolbar.png" alt-text="Screenshot that shows the toolbar that can be used to manage the rules." lightbox="media/anti-malware/rule-toolbar.png":::
+
+The toolbar lets you edit, duplicate, delete, enable, and disable rules. Select a rule and an action.
+
+Disabling a rule lets you keep the rule and its configuration without applying the rule. This option is useful if you want to stop a rule temporarily without losing its configuration.
+
+After you configure your rules, select **Save** to apply the changes and create the policy. Within 30 minutes, the sensors on the protected clusters update with the new policy.
+
+## Next step
+
+> [!div class="nextstep"]
+> [Overview of Container security in Microsoft Defender for Containers](/azure/defender-for-cloud/defender-for-containers-introduction)