1

I want to test to see if my antiviruses are working correctly and if possible to see which one is better. As each antivirus has two parts I want to test both.

For signature-based detection, I use the EICAR test file and I can also use some known viruses in restricted environments.

But what about behavioral detection like HIPS (Eset and others) and PDM (Kaspersky and maybe others)?

I wrote a little program that combines two parts of EICAR string and writes it in a file. At first Kaspersky detected the exe file with PDM when I ran it.

After a while it stopped detecting the exe file and just removes the file that my exe writes to disk.

Is there any test file similar to EICAR but for behavioral detection (I doubt that there is)? Do you have any suggestion for a program to write for this purpose?

  • 3
    I very much doubt that there is a common test file for behavior detection because there is no clear and long-time constant definition of what suspicious behavior is. And the purpose of EICAR also is not to see if signature based detection works - it is only to find out if the minimal functionality of the AV works, i.e. that it is actually able to analyze and block files. It says nothing about the quality of the detection nor about the detection method and thus applies to both signature and behavior based detection. – Steffen Ullrich Apr 14 at 7:01
  • I would experiment with a tool like AutoIt, maybe create a program that copies itself to your temp location and runs it. Maybe have it set a "Run" key to run that file from the temp location on user login, maybe change proxy settings, etc.. At least you'll have an exe, that is unsigned that is trying to make system changes to launch itself from an unusual location to run a binary from. I suspect it's more these sort of operations you're after when testing behavioural detection. – HelpingHand Apr 14 at 21:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.