Edit

Share via

Antivirus detection test for verifying device's onboarding and reporting services

Applies to:

Scenario requirements and setup

  • Windows 11, Windows 10, Windows 8.1, Windows 7 SP1
  • Windows Server 2025, Windows Server 2022, Windows Server 2019, Windows Server 2016, Windows Server 2012, and Windows Server 2008 R2
  • Linux
  • macOS
  • Real-time protection is enabled

EICAR test file to simulate malware

After you enable Defender for Endpoint, Microsoft Defender for Business, or Microsoft Defender Antivirus, you can test the service by using an EICAR test file. Running a proof of concept like this can help you get familiar with the features, and validate the advanced security capabilities that protect your device by generating real security alerts.

You can run an antivirus detection test to verify that the device is properly onboarded and reporting to the service.

Windows

  1. Prepare for the EICAR test file. Use an EICAR test file instead of real malware to avoid causing damage. Microsoft Defender Antivirus treats EICAR test files as malware.

  2. Create the EICAR test file by following these steps:

    1. Copy the following string: X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*.

    2. Paste the string into a .TXT file and save it as EICAR.txt.

Linux/macOS

  1. Ensure that real-time protection is enabled. Run the following command and confirm the output is "true":

    mdatp health --field real_time_protection_enabled

  2. Download the EICAR test file. Open a Terminal window and execute the appropriate command for your operating system:

    Linux:

    curl -o eicar.com.txt https://secure.eicar.org/eicar.com.txt

    macOS:

    curl -o ~/Downloads/eicar.com.txt https://secure.eicar.org/eicar.com.txt

  3. Verify that the file is quarantined. Run the following command to list all detected threats:

    mdatp threat list

See also