How to perform an MDS Eicar Test

Issue

Anyone is looking for a way to perform an MDS Test for Proof of Concept, for checking the functionality of database scan injection detection and cleanup.

Environment

• Imunify360
• MDS

Solution

We have a special signature SMW-INJ-16483-eicar.tst.mds-2 that may be used on such tests.

How to Test

1. Make sure of enabling MDS

# imunify360-agent config update '{"MALWARE_DATABASE_SCAN": {"enable": true}}'

2. Open the WordPress Test environment

3. Copy and paste the following special Eicar DB string into a new WP post or comment:

<script>X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-MDS-ANTIVIRUS-TEST-FILE!$H+H*

4- Start a new scan

# imunify360-agent malware on-demand start --path /var/www/vhosts/test.mds/

5- Check results

# imunify360-agent malware malicious list --search test.mds

It should provide the following output:

wp_core   1647975835.8383954  1647975826  127.0.0.1  wp_4txwz  3306     {}          /var/www/vhosts/test.mds/httpdocs/wordpress  None  4   True       db             73af8e4c66cf43a0b145a7b1289afde7  user       None  cleanup_done  SMW-INJ-16483-eicar.tst.mds-2  gsoares 

Useful links

https://blog.imunify360.com/release-notes-imunify360-v.6.0-malware-database-scanner