Linux VMs absent from the endpoint-protection lookup set
What does ZopNight detect here?
ZopNight marks a Linux Azure VM unprotected only when the discoverer fetched the IaaSAntimalware/Defender lookup set and the VM was provably absent from it. That is an authoritative false, never a missing-signal default. Windows VMs are skipped entirely, because Windows Server 2016 and later ship Microsoft Defender Antivirus built in.
Signal and threshold
| Field | Value |
|---|---|
| Rule IDs | RC-1304 |
| Category | compliance |
| Severity | high |
| Metric | none — pure configuration read |
| Source | vm_antimalware.go |
Where it applies
A lookup-set absence that counts as evidence
The Azure discoverer queries which VMs carry the IaaSAntimalware extension or a Microsoft
Defender for Endpoint onboarding, then stamps antimalware_enabled true or false per VM. The
crucial property: "false" is written only when that lookup set was successfully fetched and
the VM was not in it. So a false here is a positive statement rather than an inference from
missing data: the fleet was enumerated and this machine has no endpoint protection. When the
enricher has not run or the lookup failed, the key is absent and the rule abstains.
Why no Windows VM ever appears in these findings
Windows Server 2016 and later ship Microsoft Defender Antivirus in the base image. Flagging a
Windows VM for lacking the IaaSAntimalware extension would accuse a protected machine of being
unprotected, so the rule checks the discoverer’s os_family key (falling back to os_type)
and skips anything Windows. The guard deliberately fails open in the other direction: an
absent OS attribute does not assume Windows, because that assumption would silently suppress
genuine Linux findings.
What an unprotected Linux host means in practice
Linux has no built-in equivalent of Defender AV. A flagged VM is running with no real-time malware detection, no ransomware behavioural blocking, and nothing feeding endpoint telemetry into Defender for Cloud. An auditor working through CIS or PCI-DSS endpoint-protection controls will treat it as a straightforward gap, and an attacker who lands on the box operates unobserved. Severity is high for that reason, though the finding itself carries no dollar figure.
Enumerate a VM’s security extensions
az vm extension list -g <rg> --vm-name <vm> \ --query "[].{name:name, publisher:publisher, state:provisioningState}" -o tableLook for MDE.Linux or a third-party endpoint agent in the list; an empty result on a Linux
VM corroborates the finding.
Closing the gap
Onboard Microsoft Defender for Endpoint for Linux (the MDE.Linux extension) through Defender
for Cloud, or deploy the endpoint agent your organisation has standardised on, then enable
real-time protection and scheduled scans. Detection is reproducible with Reader alone;
ZopNight installs nothing on the machine.