Azure Defender On Linux VM - Help With Exit Codes

You're right, mdatp's exit codes might not behave exactly as expected. Here's what you can do:

Refer to Microsoft Documentation: While there isn't specific documentation on exit codes for mdatp, you can look for similar tools from Microsoft Defender. Microsoft Defender Antivirus uses exit codes 0 and 2 - 0 for success (no threat) and 2 for failures or threats found https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-antivirus-windowshttps://umactrackshipment.com/ This might be a similar behavior for mdatp.

Test with a Sample Threat: Create a test file with a known malware signature and try scanning it with mdatp. If it still returns 0, then it's likely mdatp uses a different scheme.

Alternative Approach: Parsing mdatp Output: If exit codes are unreliable, consider parsing the text output of mdatp. The output should indicate if any threats were found. You can use tools like grep to search for keywords related to threats within the output.

Here's a possible approach using grep:

Bash
scan_result=$(mdatp <file_path>)

if grep -i "threat found" <<< "$scan_result" > /dev/null; then
echo "Threat identified!"
else
echo "Scan completed successfully. No threats found."
fi
Use code with caution.
content_copy
This script scans the file with mdatp and stores the output in scan_result. Then, it uses grep to search for the case-insensitive phrase "threat found" within the output. If grep finds a match, it means a threat was identified.

Remember to replace <file_path> with the actual path to the file you want to scan. This is a basic example, and you might need to refine the grep pattern based on mdatp's specific output format.