The company where I work recently got through a security audit. Everything seems to be solid except our Sophos Cloud Security AV.
I was asked to try and download some of these ClamAV test files on our machines (in particular: clam.mail
and clam.zip
), expecting them to be blocked by Sophos, but instead I could not only download, but also open the files.
I tried it on my MacBook running macOS Sierra and on an up-to-date Windows 10 laptop, but the end result is the same. Sophos doesn't see these files as threats and doesn't block them.
According to the audit team, these are standard "dummy" test files that are just meant to be picked up by antivirus software, but are innocuous.
Having a look around, it seems that the standard files used in this scenario are actually the EICAR ones. Unlike the ClamAV ones, these are picked up correctly by our Sophos AV software.
We tried contacting Sophos support, but we're still awaiting a response.
In the meantime we tried the same ClamAV files on other test machines with different AV software (namely Windows Defender and F-Secure for now) and none of these pick up the threat.
Since this is the only step preventing us from passing the audit, it would be really important to understand wether it's the Sophos software that should block the files, or if the files themselves are not the correct ones to test an AV functionality.