diff --git a/include/tests_malware b/include/tests_malware
index 0cc9424f..d5f26e9f 100644
--- a/include/tests_malware
+++ b/include/tests_malware
@@ -26,6 +26,7 @@
 #
 #################################################################################
 #
+    AVAST_DAEMON_RUNNING=0
     CLAMD_RUNNING=0
     CLAMSCAN_INSTALLED=0
     ESET_DAEMON_RUNNING=0
@@ -109,6 +110,19 @@
             Report "malware_scanner[]=eset"
         fi
 
+        # Avast (macOS)
+        LogText "Test: checking process com.avast.daemon"
+        IsRunning com.avast.daemon
+        if [ ${RUNNING} -eq 1 ]; then
+            FOUND=1
+            Display --indent 2 --text "- ${GEN_CHECKING} Avast daemon" --result "${STATUS_FOUND}" --color GREEN
+            LogText "Result: found Avast security product"
+            AVAST_DAEMON_RUNNING=1
+            MALWARE_SCANNER_INSTALLED=1
+            AddHP 2 2
+            Report "malware_scanner[]=avast"
+        fi
+
         # McAfee products
         LogText "Test: checking process cma or cmdagent (McAfee)"
         # cma is too generic to match on, so we want to ensure that it is related to McAfee first