Sharepoint on premises AMSI and Windows defender. Is the AMSI integration with MDAV able to scan uploaded files in real time and block malicious files?

Question

Hello,

I need more clarification on this aspect:

By default, Microsoft Defender Antivirus (MDAV), an AMSI-capable solution, is automatically enabled and installed on endpoints and devices that are running Windows 10, Windows Server 2016, and later. If you haven't installed an antivirus/anti-malware application, SharePoint Server AMSI integration will work with MDAV. So, you do not need to a third-party antivirus.

This means that MDAV will scan in real time uploaded files (on a sharepoint site) and block them if they are malicious?

Thank you

Answer 1

Hi Adelina Slavu.

Below is a breakdown based on real-time scanning and blocking of Malicious files

1. Real-Time Scanning: MDAV, being an AMSI-capable solution, is automatically enabled and installed on endpoints and devices running Windows 10, Windows Server 2016, and later. This integration allows MDAV to work seamlessly with SharePoint Server AMSI, ensuring that files uploaded to SharePoint sites are scanned for malware.
2. Blocking Malicious Files: If a file is found to be malicious during the scan, MDAV will block it to prevent any potential harm. This real-time protection helps in maintaining the security of your SharePoint environment.

Further to ascertain that you can go further and test AMSI integration with the Sharepoint Server. Below are the steps.

You can now test and verify the Antimalware Scan Interface (AMSI) feature by including a test string in the requests that you send to the SharePoint Server. The test string isn’t dangerous, but if AMSI integration is enabled in SharePoint Server and is using Microsoft Defender as its malware detection engine, then Microsoft Defender detects the string and blocks the request as if it was malicious. 

Steps: 

The test string is similar to EICAR test file but differs slightly to avoid URL encoding confusion. 

You can verify the test string by using either in a query string or including in a HTTP header in your request to the SharePoint Server. 

Refer to: https://microsoft.github.io/CSS-Exchange/Admin/Test-AMSI/ 

Note 

If you are using a malware detection engine other than Microsoft Defender, then you should check with your malware detection engine vendor to determine the best way to test your integration with the AMSI feature in SharePoint Server. 

If you find the answer above helpful, please Accept the answer to help anyone in the community who might have a similar question to quickly find the solution.