diff --git a/db/tests.db b/db/tests.db
index 5b005e1b..f62e9a19 100644
--- a/db/tests.db
+++ b/db/tests.db
@@ -276,6 +276,7 @@ MALW-3284:test:security:malware::Check for clamd:
 MALW-3286:test:security:malware::Check for freshclam:
 MALW-3288:test:security:malware::Check for ClamXav:
 MALW-3290:test:security:malware::Presence of malware scanner:
+MALW-3291:test:security:malware::Check for Microsoft Defender Antivirus:
 NAME-4016:test:security:nameservices::Check /etc/resolv.conf default domain:
 NAME-4018:test:security:nameservices::Check /etc/resolv.conf search domains:
 NAME-4020:test:security:nameservices::Check non default options:
diff --git a/include/consts b/include/consts
index 5d618429..714f4a92 100644
--- a/include/consts
+++ b/include/consts
@@ -169,6 +169,7 @@ ETC_PATHS="/etc /usr/local/etc"
     MACHINEID=""
     MACHINE_ROLE=""
     MALWARE_SCANNER_INSTALLED=0
+    MDATPBINARY=""
     MIN_PASSWORD_LENGTH=-1
     MONGODB_RUNNING=0
     MOUNTBINARY=""
diff --git a/include/tests_malware b/include/tests_malware
index 87a721bc..d2a4378f 100644
--- a/include/tests_malware
+++ b/include/tests_malware
@@ -369,6 +369,24 @@
     fi
 #
 #################################################################################
+#
+    # Test        : MALW-3291
+    # Description : Check if Microsoft Defender Antivirus is installed
+    Register --test-no MALW-3291 --weight L --network NO --category security --description "Check for mdatp"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        LogText "Test: checking presence mdatp"
+        if [ ! "${MDATPBINARY}" = "" ]; then
+            Display --indent 2 --text "- Checking Microsoft Defender Antivirus" --result "${STATUS_FOUND}" --color GREEN
+            LogText "Result: Found ${MDATPBINARY}"
+            MALWARE_SCANNER_INSTALLED=1
+            AddHP 2 2
+            Report "malware_scanner[]=mdatp"
+        else
+            LogText "Result: mdatp couldn't be found"
+        fi
+    fi
+#
+#################################################################################
 #
     # Test        : MALW-3286
     # Description : Check running freshclam if clamd process is running