Azure site recovery cache storage identified with mallware

Hi Adrian,

This can happen in Azure Site Recovery because during replication, temporary files are created in the cache storage account. Microsoft Defender may flag these temp files with signatures resembling malware—even when the source servers are clean.

Here are a few things to check:

• Confirm your source servers are clean (sounds like you already did).
• Review the Defender alerts—these are often false positives triggered by replication artifacts.
• If confirmed safe, consider adding exclusions for the cache storage path.
• You can also open a Microsoft Support case to validate the signatures and rule out edge cases.

It’s not uncommon to see this behavior in replication scenarios, but it’s always best to validate if the detections persist—especially in production environments.

Hope that helps!