How to Test Antivirus Alerts with Microsoft Defender and EICAR

Use the EICAR test file to safely test whether Microsoft Defender Antivirus alerts are working. On an approved Windows test device, download the EICAR ZIP test file, confirm Defender blocks or quarantines it, then verify the same detection appears in the place your team monitors: Windows Security, Microsoft Defender for Endpoint, DefenderReporter, or your RMM.

The important distinction is this: "Defender detected the file" and "my team received the alert" are different checks. A useful antivirus alert test validates both the endpoint detection and the reporting path. If you are still building the larger alert-handling process, pair this test with the Defender alert triage workflow.

EICAR is a safe antivirus test file. Security products are expected to recognize it as a test pattern, which makes it useful for proving that antivirus detection and reporting paths are alive without handling real malware.

It is best for answering:

• Can Microsoft Defender Antivirus detect a known test file?
• Does the endpoint show the detection in Windows Security or Protection history?
• Does the detection reach the portal, dashboard, RMM, or reporting workflow we monitor?
• Do the right people receive the expected notification?

It does not prove every security control is working. EICAR does not fully validate behavior-based detection, phishing protection, attack surface reduction rules, SmartScreen reputation checks, every Defender for Endpoint alert rule, or every custom RMM integration. Treat it as a safe alert-path test, not a complete security assessment.

Run the test only on an approved endpoint and tell the team what you are testing before you start. Pick one device, record the test time, and know where the alert is supposed to land.

A simple test plan looks like this:

1. Confirm Microsoft Defender Antivirus is active on the test device.
2. Confirm the device has current security intelligence.
3. Download the EICAR ZIP test file from the official EICAR HTTPS site.
4. Check whether Defender blocks, quarantines, or records the detection.
5. Verify the event in your central alert workflow.
6. Document the result and clean up any remaining test artifact.

If Defender is not active or current before the test, fix that first. Use the Defender status guide and the Defender update-status guide before you trust the alert result.

From Command Prompt, a simple EICAR download test can look like this:

curl.exe --output C:\temp\eicartest.zip https://secure.eicar.org/eicar_com.zip

Use curl.exe when you want a plain Command Prompt test. In some PowerShell contexts, curl can behave differently because of aliases or shell handling, so the explicit executable name keeps the example clearer.

If Microsoft Defender Antivirus is active and current, it may block or quarantine the file during download before the ZIP is fully saved. That is still a successful detection test. Record the command time, hostname, username, and expected alert destination so you can verify whether the same event appears in Windows Security, Defender for Endpoint, and your RMM or reporting dashboard.

If the file downloads cleanly and remains on disk, do not assume the environment is safe. First verify that Defender is active, not passive, and using current signatures. If a different antivirus product is installed, see the third-party antivirus handoff guide.

Start on the endpoint where you ran the test.

Check these local places first:

• Windows Security notifications or Notification Center
• Windows Security > Virus & threat protection > Protection history
• Defender status fields from PowerShell
• local event history if you need audit evidence

For a quick status check, use:

Get-MpComputerStatus | Select-Object AMRunningMode, AntivirusEnabled, RealTimeProtectionEnabled, AntivirusSignatureLastUpdated

That does not replace the alert record, but it helps explain confusing results. If Defender is passive, disabled, stale, or managed by policy, the EICAR test may not behave the way you expected.

If EICAR was detected but no visible Defender alert appeared, separate the problem into layers.

Microsoft documents separate controls for endpoint notifications. Some notification settings reduce additional notifications, while critical threat and remediation notifications are handled differently. For the local notification side, use the Windows Defender notifications guide.

If Defender is present but not the active antivirus engine, use the passive mode guide. If you need to decide whether Defender found anything beyond this test, continue with the detection-check guide.

Microsoft Defender Antivirus detection and Microsoft Defender for Endpoint alert notification are related, but they are not the same layer.

Before you judge the Defender for Endpoint alert path, confirm:

• the device is onboarded to Defender for Endpoint or Defender for Business
• the device is healthy and recently active in the portal
• the alert appears in the Defender portal alerts queue, or you know why it should not
• the notification rule includes the relevant devices or device groups
• the notification rule includes the severity level you expect
• the recipient list is current
• mail filtering, inbox rules, or security gateways are not hiding the message

Defender XDR email notification rules can be scoped by device and alert severity, and Microsoft notes that recipient access can depend on RBAC and device group scope. That means a working local detection does not automatically prove every portal notification recipient should receive an email.

For a clean validation, record the EICAR test time and device name, wait for the portal to process the event, then compare the portal alert, notification email, and monitored dashboard result.

For MSPs and lean IT teams, the real control is not just "Defender blocked EICAR." The real control is whether the alert reached the queue someone reviews.

Use this evidence table for each test:

If the alert reaches Windows Security but not the RMM, focus on collection and mapping. Check whether your tool watches Defender events, Defender for Endpoint alerts, Windows Security Center status, or a custom agent feed. Those are different paths, and an EICAR detection can expose which one your RMM is actually using.

In DefenderReporter, the same idea applies to the detection queue: use the local test evidence to confirm whether the central dashboard shows the endpoint, detection, and timestamp your team expects. If the central queue is the daily source of truth, this test should prove the route from endpoint event to reviewed alert.

Capture enough information that someone else can repeat the test and understand the result later.

Minimum evidence:

• test date and time
• hostname and signed-in user
• Defender running mode and real-time protection status
• signature freshness before the test
• EICAR command or download method used
• local Defender result
• Defender for Endpoint result if applicable
• RMM or reporting-dashboard result
• notification recipient result
• cleanup and closure note

This keeps the test from becoming a one-off screenshot with no operational value. Over time, these records show whether alert routing is reliable, delayed, noisy, or silently broken.

The biggest mistake is using live malware to test alerting. Do not do that. EICAR exists so you can validate the alert path without introducing real risk.

Other common mistakes include:

• stopping the test as soon as Defender blocks the file
• forgetting to check whether Defender is active or passive before testing
• expecting a local pop-up and a Defender for Endpoint email to behave the same way
• not allowing for portal, RMM, or polling delay
• testing without recording hostname and exact time
• treating a missing notification as proof that Defender failed, when only the reporting path failed

The better pattern is simple: test safely, validate each layer separately, and close the loop where your team actually reviews alerts. That turns an EICAR test from a quick trick into useful reporting evidence.

This guide was built from primary EICAR and Microsoft documentation:

• EICAR: Download Anti Malware Testfile
• Microsoft Learn: Configure Microsoft Defender Antivirus notifications
• Microsoft Learn: Configure alert notifications in Microsoft Defender XDR
• Microsoft Learn: Get-MpComputerStatus