Edit

Share via

Antivirus detection test for verifying device's onboarding and reporting services

  • Applies to: Microsoft Defender for Endpoint Plan 1, Microsoft Defender for Endpoint Plan 2, Microsoft Defender for Business, Microsoft Defender for Individuals

Prerequisites

Supported operating systems

  • Windows 11, Windows 10, Windows 8.1, Windows 7 SP1
  • Windows server 2016 and later
  • Windows Server 2012, and Windows Server 2008 R2
  • Azure Stack HCI OS, version 23H2 and later
  • Linux
  • macOS

EICAR test file to simulate malware

After you enable Defender for Endpoint, Microsoft Defender for Business, or Microsoft Defender Antivirus, you can test the service by using an EICAR test file. Running a proof of concept like this can help you get familiar with the features, and validate the advanced security capabilities that protect your device by generating real security alerts.

You can run an antivirus detection test to verify that the device is properly onboarded and reporting to the service.

Windows

  1. Prepare for the EICAR test file. Use an EICAR test file instead of real malware to avoid causing damage. Microsoft Defender Antivirus treats EICAR test files as malware.

  2. Create the EICAR test file by following these steps:

    1. Copy the following string: X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*.

    2. Paste the string into a .TXT file and save it as EICAR.txt.

  3. Open a Command Prompt and run: type EICAR.txt.

Linux/macOS

  1. Ensure that real-time protection is enabled. Run the following command and confirm the output is "true":

    mdatp health --field real_time_protection_enabled

  2. Download the EICAR test file. Open a Terminal window and execute the appropriate command for your operating system:

    Linux:

    curl -o eicar.com.txt https://secure.eicar.org/eicar.com.txt

    macOS:

    curl -o ~/Downloads/eicar.com.txt https://secure.eicar.org/eicar.com.txt

  3. Verify that the file is quarantined. Run the following command to list all detected threats:

    mdatp threat list

See also

  • Last updated on