diff --git a/defender-endpoint/validate-antimalware.md b/defender-endpoint/validate-antimalware.md
index ce2a55e87f..5d8098f0f4 100644
--- a/defender-endpoint/validate-antimalware.md
+++ b/defender-endpoint/validate-antimalware.md
@@ -52,7 +52,9 @@ You can run an antivirus detection test to verify that the device is properly on
    1. Copy the following string: `X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*`.
    
    2. Paste the string into a `.TXT` file and save it as `EICAR.txt`.
-            
+
+3. Open a Command Prompt and run: `type EICAR.txt`.
+
 ### Linux/macOS
 
 1. Ensure that real-time protection is enabled. Run the following command and confirm the output is `"true"`:
@@ -86,4 +88,4 @@ You can run an antivirus detection test to verify that the device is properly on
 - [Microsoft Defender for Endpoint - demonstration scenarios](defender-endpoint-demonstrations.md)  
 - [Microsoft Defender Antivirus in Windows Overview](microsoft-defender-antivirus-windows.md)  
 - [Microsoft Defender for Endpoint on Linux](microsoft-defender-endpoint-linux.md)  
-- [Microsoft Defender for Endpoint on macOS](microsoft-defender-endpoint-mac.md)
\ No newline at end of file
+- [Microsoft Defender for Endpoint on macOS](microsoft-defender-endpoint-mac.md)