max / makenotwork
| 1 | // MakeNotWork - AV test vectors (deterministic, zero false positives). |
| 2 | |
| 3 | rule eicar_test_file { |
| 4 | meta: |
| 5 | description = "EICAR anti-virus test file" |
| 6 | reference = "https://www.eicar.org/download-anti-malware-testfile/" |
| 7 | strings: |
| 8 | $eicar = "X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*" |
| 9 | condition: |
| 10 | $eicar |
| 11 | } |
| 12 |