Use webhook action for alert when new instances is provisioned to install the antivirus.
You can either place the action to install the package when alert is received on new instance is created.
Or you can use a logic app as when when an alert is generated for a new instance creation to install the antivirus.