Can Azure Defender for storage find virus in encrypt files?

Question

Hi team, we're evaluating Azure Defender for storage (https://learn.microsoft.com/en-us/azure/security-center/defender-for-storage-introduction) as a solution to help us find infected files reactively.

However, we do encrypt file at the application layer before being saved to the storage. Wonder if Azure Defender will be able to pick up the virus in this scenario.

Thanks!

Answer 1

@Hsuan-Kai Huang To determine whether an uploaded file is suspicious, Azure Defender for Storage uses hash reputation analysis supported by Microsoft Threat Intelligence. The threat protection tools don’t scan the uploaded files, rather they examine the storage logs and compare the hashes of newly uploaded files with those of known viruses, trojans, spyware, and ransomware. Since the file you uploaded is encrypted, Azure Defender will not have any reputation of the file. You will need to scan the file prior to encrypting in your application. There are some other solutions posted in this thread which might be helpful for your use-case.

-------------------------------

Please don’t forget to "Accept the answer" and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.