The whole catalogue, generated from the client's own registry rather than written by hand — so this page cannot drift from the binary you downloaded. Each entry says what it does, what a healthy reaction looks like, which ATT&CK techniques it maps to, and which consent flag it sits behind.
Public, inert test files — EICAR and friends — written in several shapes to see how deeply the scanner looks.
Writes the document shapes phishing campaigns use — a macro-enabled OOXML package with a vbaProject part, an HTA script, a Windows script file and a shortcut-style command file — each carrying inert test content. None of them is a working document and nothing is opened or executed.
macOS Linux Windows
Fetches the EICAR test file from the official eicar.org endpoints (an AMTSO test resource) to observe whether the download path — proxy, TLS inspection or on-access scanner — intercepts it.
macOS Linux Windows network
Writes the standard 68-byte EICAR anti-malware test file into the sandbox and re-checks it for several seconds to catch asynchronous quarantine.
macOS Linux Windows
Writes six on-disk shapes of the EICAR test file (plain, double extension, padded, prefixed, zipped, nested zip) to compare how deeply the scanner inspects files.
macOS Linux Windows
Real samples from MalwareBazaar, downloaded and unpacked only. Nothing executes a sample and no code path exists to.
Downloads real malware samples from MalwareBazaar as password-protected ZIP archives and unpacks them into the sandbox, to see whether the download or the on-disk write is detected. THE SAMPLES ARE NEVER EXECUTED. Requires --live-samples and an abuse.ch key in addition to consent, and everything is deleted immediately.
macOS Linux Windows --i-understand network
Downloads mimikatz and two PowerSploit scripts to a temporary file to see whether the proxy, DNS filter or on-access scanner intervenes. The files are never executed and are deleted immediately.
macOS Linux Windows --i-understand network
Queries abuse.ch's MalwareBazaar API for recently submitted samples and records the hashes and family labels it returns. Metadata only: no sample is requested, so nothing malicious touches this host. What is measured is whether the host can reach a malware repository at all.
macOS Linux Windows network
Well-known strings that any scanner is expected to recognise, written to disk and to memory.
Wraps one payload (the EICAR test file) in twenty different containers and encodings — nested ZIPs from one to ten layers deep, a password-protected ZIP, tar/gzip, base64/hex/ROT13, an NTFS alternate data stream, mark-of-the-web, and filename tricks — to find the exact point where the scanner stops looking.
macOS Linux Windows
Writes a wider set of public, inert detection-test material — EICAR in several encodings and document wrappers, offensive-tooling command strings, webshell one-liners, and the Metasploit block-API byte pattern as inert data — and records which ones the scanner reacts to.
macOS Linux Windows
Writes a set of public, inert detection-test strings (EICAR, GTUBE, Microsoft's AMSI test sample, credential-dumping command text, UTF-16 EICAR) and records which ones the scanner reacts to.
macOS Linux Windows
Mass renaming, extension changes and shadow-copy interference — inside a sandbox the client created itself.
Deletes the machine's volume shadow copies with vssadmin and disables the boot recovery environment, the steps ransomware takes so a restore is impossible. This CANNOT be undone: the shadow copies are gone. It needs --allow-irreversible as well as consent.
Windows --i-understand irreversible wants admin
Creates 120 low-entropy documents in the sandbox and encrypts every one of them in place with AES-256, so the on-disk entropy of each file jumps from ordinary text to statistically flat. That jump is what entropy-based anti-ransomware watches for, and a rename alone cannot reproduce it. Only files this test created are touched.
macOS Linux Windows --i-understand
Creates 240 documents in a sandbox directory, then renames them all to a .locked extension, overwrites a subset with high-entropy data and drops a ransom note — the behavioural pattern anti-ransomware engines watch for. Only files created by this test are touched.
macOS Linux Windows --i-understand
Renames sandbox documents to the extensions real families use (.locky, .wcry, .ryuk and others) and drops a ransom note in every subdirectory, which is the pattern filename and note-based rules match on. The note says in its own text that it is a benchmark artefact.
macOS Linux Windows --i-understand
Renames 600 sandbox files in paced batches of 50, recording how many had been renamed when something first intervened. That number is the detection threshold, which is far more useful than a yes/no answer: it says how much damage happens before the alarm.
macOS Linux Windows --i-understand
Read-only search for the canary and decoy files anti-ransomware products place on disk to detect mass file modification. Finding them shows behavioural ransomware protection is deployed; being prevented from listing them is itself a detection signal.
macOS Linux Windows
Encoded commands, script interpreters and the AMSI test string: the shapes a script-block policy is supposed to catch.
Passes Microsoft's published AMSI test sample string to PowerShell. A working Antimalware Scan Interface provider must refuse the script, so a clean run means script scanning is absent or bypassed.
Windows
Executes a recon command hidden with caret escaping and environment-variable substitution on Windows, or quote splitting on macOS/Linux — the string-obfuscation tricks command-line telemetry is supposed to see through.
macOS Linux Windows
Uses the Net.WebClient download-cradle pattern (Windows) or a curl-into-shell pipeline (macOS/Linux) against a harmless connectivity endpoint. The fetched content is measured, never executed.
macOS Linux Windows network
Runs a base64-encoded command through powershell -EncodedCommand (Windows) or a base64 pipe into sh (macOS/Linux). The payload only prints a marker and enumerates the OS version; the obfuscation itself is what should be flagged.
macOS Linux Windows
Signed system binaries used the way an intruder uses them, which is what makes them hard to alert on.
Fetches a two-byte file from the benchmark's own endpoint using each signed OS tool an attacker would use for it — certutil, bitsadmin, curl, wget, python, osascript — and records which invocations were stopped. Nothing that is downloaded is executed.
macOS Linux Windows network
Uses the signed script hosts — mshta, regsvr32 with scrobj, rundll32, wmic, cscript, osascript, perl, python — to execute an inert instruction that writes a marker file in the sandbox, and records which of those execution routes are permitted.
macOS Linux Windows
Writes a base64-encoded EICAR test file and decodes it in place with the platform's own signed decoder (certutil on Windows, base64 elsewhere), which is how encoded payloads are reconstituted on disk without a downloader.
macOS Linux Windows
Writing into another process the client started itself, so nothing on the machine is disturbed.
Performs the classic OpenProcess / VirtualAllocEx / WriteProcessMemory / CreateRemoteThread sequence against a child process this test starts itself, with a stub that does nothing but return. Each API call is recorded separately so the report shows which one was refused.
Windows --i-understand
Starts a child process with LD_PRELOAD (or DYLD_INSERT_LIBRARIES on macOS) pointing at a library in the sandbox, the standard Unix code-injection route. The library is deliberately not a loadable object, so nothing can execute; the loader's attempt to preload it is the observable event.
macOS Linux --i-understand
Attaches to a child process with ptrace, reads its registers and detaches again. On Linux this is the equivalent of a debugger taking over another process, and it is what eBPF-based tooling and a correctly set ptrace_scope are meant to notice.
Linux --i-understand
Attempts to gain rights the current user does not have. Every change is reverted.
Creates a local user, adds it to the local administrators group, verifies the membership and then deletes it again. Account creation followed by a privileged group change is one of the highest-signal events an EDR can see.
macOS Linux Windows --i-understand
Reading the places credentials live — the read is what should be alerted on, so nothing is exfiltrated.
Attempts the comsvcs.dll MiniDump technique through rundll32 — the most-alerted-on credential-dumping method there is — writing to the sandbox. Any dump produced is deleted immediately and only its size and digest are reported, never its contents.
Windows --i-understand wants admin
Locates the browser password and cookie databases for Chrome, Edge, Brave and Firefox and copies them into the sandbox, which is exactly what an infostealer does first. Copies are deleted immediately; no database is ever parsed or decrypted.
macOS Linux Windows --i-understand
Enumerates and copies the current user's DPAPI master key blobs, which are what an attacker needs to decrypt saved browser and Credential Manager secrets offline. Copies are deleted immediately and never parsed.
Windows --i-understand
Runs security(1) to list the login keychain's item metadata and to dump the keychain without the -d flag, so no secret is ever requested or printed. Keychain enumeration is what macOS stealers do before prompting the user for their password.
macOS
Opens a read handle to the LSASS process with PROCESS_VM_READ and closes it immediately without reading a single byte. Handle acquisition is the step credential-theft detections hook, so this measures the hook rather than the theft.
Windows wants admin
Looks for SSH private keys, cloud CLI credentials, Kubernetes and Docker configuration, .netrc and package-manager tokens, and for credential-shaped environment variables. Only paths, sizes and digests are recorded — never any secret material.
macOS Linux Windows
Attempts to copy the operating system's credential stores into the sandbox — the SAM, SYSTEM and SECURITY registry hives on Windows, /etc/shadow on Linux, the local directory database on macOS. Reads only; the copies are deleted immediately.
macOS Linux Windows --i-understand
Every mechanism that survives a reboot: services, tasks, run keys, launch agents, cron, shell profiles.
Creates a permanent WMI event filter, a command-line consumer bound to it, and the binding between them — the fileless persistence mechanism that survives reboots and lives entirely in the WMI repository. All three objects are removed again.
Windows --i-understand wants admin
Adds a no-op entry to the current user's crontab and removes it again. The existing crontab is backed up into the sandbox before the change and restored from that backup, so an existing schedule cannot be lost even if this worker is killed mid-write.
Linux --i-understand
Writes a launch agent plist into the current user's LaunchAgents directory, loads it with launchctl, then unloads and deletes it. The agent would only run /usr/bin/true. This is the standard macOS persistence mechanism.
macOS --i-understand
Writes an inert autorun value under HKCU ...\CurrentVersion\Run, verifies it, then deletes it again. The value only runs cmd.exe /c exit, and it is removed before the test returns (and by the supervisor if this worker is killed).
Windows --i-understand
Registers a scheduled task that would run a no-op command at logon, verifies it exists, then deletes it. Scheduled tasks are the most common persistence mechanism after Run keys and are monitored separately by most products.
Windows --i-understand
Appends a commented no-op line to the current user's shell profile and then restores the file from a byte-for-byte backup taken beforehand. Shell profiles execute on every interactive login and are rarely watched.
macOS Linux --i-understand
Drops a no-op command file into the current user's Startup folder, confirms it is there, and deletes it again. This is the oldest autostart mechanism on Windows and needs no registry access at all.
Windows --i-understand
Installs a systemd user service that would run /usr/bin/true, enables it, then disables and deletes it. A user unit needs no root at all, which is what makes it attractive and worth monitoring.
Linux --i-understand
Turning the defences off, adding exclusions, clearing logs, backdating timestamps. All reverted where it can be.
Adds the sandbox directory to Microsoft Defender's exclusion list, verifies whether it took effect, and removes it again. Adding an exclusion is how commodity malware blinds Defender before unpacking itself, and tamper protection is expected to refuse the change.
Windows --i-understand wants admin
Attempts to turn off Microsoft Defender's real-time monitoring through Set-MpPreference and turns it back on again. With tamper protection enabled this must fail; if it succeeds, the host can be disarmed by anything running with the same rights.
Windows --i-understand wants admin
Identifies which EDR/AV/telemetry services are actually running on this host and attempts to stop up to three of them, then restarts them. Tamper protection is expected to refuse; if a service does stop, that is the finding. The restart is recorded in a revert plan first, so the supervisor restores the service even if this worker is killed.
macOS Linux Windows --i-understand wants admin
Runs the published AMSI bypass one-liner in PowerShell and then feeds AMSI's own test string through Invoke-Expression, to establish whether script scanning can be switched off from inside a script. Nothing is written and no machine state changes.
Windows
Clears the Windows Application event log, which is the anti-forensic step that follows a successful intrusion and raises event 1102. This cannot be undone, so it needs --allow-irreversible as well as consent. The Security log is deliberately left alone so the SOC keeps the evidence of this run.
Windows --i-understand irreversible wants admin
Turns the host firewall off and immediately back on, using the platform's own tool (netsh advfirewall, socketfilterfw, ufw or firewalld). The re-enable is written to a revert plan before the change, so the firewall comes back even if this worker is killed while it is off.
macOS Linux Windows --i-understand wants admin
Backdates the modification and access times of a sandbox file to 2009 and verifies the change, the standard anti-forensic step for making a dropped file blend into a system directory. Only files this test created are touched.
macOS Linux Windows
The reconnaissance an intruder does in the first ten minutes: users, shares, domain, security products.
Runs the read-only directory queries that precede every AD attack: domain controllers, domain and enterprise administrators, password policy, trusts, and a bulk user and computer listing via LDAP. Nothing is modified and no credential is supplied beyond the session's existing context.
macOS Linux Windows network
Enumerates accounts with a servicePrincipalName — the exact target list a Kerberoast attack works from — and reports how many were found and how many are privileged. No service ticket is requested, so no crackable material is ever obtained.
macOS Linux Windows network
TCP-connect sweep of up to 24 neighbouring addresses in the local /24 on ports 445/3389/22/80/139. Strictly limited to the local subnet; no payload is sent and nothing beyond the /24 is touched.
macOS Linux Windows network
Runs the read-only enumeration commands that normally follow a successful intrusion (user, group, domain, share, process, network and shadow-copy listings). Nothing is modified.
macOS Linux Windows
Reaching neighbouring hosts and admin surfaces — attempted, never completed against anything but the loopback.
Broadcasts LLMNR, NBT-NS and mDNS queries for a hostname that cannot exist. On a healthy network nothing answers; an answer means a poisoner such as Responder is running and harvesting credentials, which is a live-intrusion finding rather than a configuration one.
macOS Linux Windows network
Connects to the remote-administration ports of neighbouring hosts in the local /24 — SMB, RDP, WinRM, SSH, RPC and VNC — to establish whether this host can reach the services lateral movement needs. No credentials are offered and no payload is sent.
macOS Linux Windows network
Asks neighbouring hosts to list their SMB shares without supplying credentials — the null session that used to be the first step of every intrusion. Nothing is mounted, read or written.
macOS Linux Windows network
Resolves the WPAD hostname and requests wpad.dat over HTTP, the automatic-proxy discovery path that lets anyone who answers first become the man in the middle for the whole host.
macOS Linux Windows network
Known-bad destinations, Tor, outbound SSH, beaconing and non-standard ports.
Sends a series of small, jittered HTTPS requests to a single endpoint with an attacker-shaped user agent and an opaque base64 body, producing the regular low-volume pattern network detection scores on. The destination defaults to the benchmark's own server.
macOS Linux Windows network
Opens a raw TCP connection to a controlled host and exchanges shell-flavoured text over it — a prompt, a command name, a response — without any shell being involved at either end. This is what deep packet inspection is expected to recognise on a non-HTTP conversation.
macOS Linux Windows network
Attempts TCP connections to the Tor network's published directory authorities. Reaching them means an endpoint on this network could bootstrap Tor and tunnel out.
macOS Linux Windows network
Looks for a Tor SOCKS proxy on this host and, if one is listening, performs a full SOCKS5 handshake and fetches a published onion service through it. With no local proxy it falls back to a tor2web gateway over ordinary HTTPS, which needs no Tor software at all.
macOS Linux Windows network
Attempts outbound TCP connections on the ports malware habitually uses — 4444, 1337, 8080, 8443, 31337, 6667 — against a public service that answers on any port, to establish whether egress is restricted by port at all. No data is sent.
macOS Linux Windows network
Opens and immediately closes TCP connections to addresses in Chinese network ranges to establish whether geo-based egress filtering exists. No data is sent.
macOS Linux Windows network
Opens an SSH connection to a remote server and completes the protocol's identification exchange — reading the server's SSH-2.0 banner and sending our own — on port 22 and on 2222, then closes it. No authentication is attempted and no credentials are ever sent.
macOS Linux Windows network
Fetches the official Tor Browser bundle from torproject.org to establish whether an anonymising client can be obtained on this network. The download is capped, never executed and deleted immediately.
macOS Linux Windows --i-understand network
Resolves public malware/phishing test domains and looks for NXDOMAIN or sinkhole answers, which is how DNS filtering announces itself.
macOS Linux Windows network
Getting synthetic data out: DNS tunnelling, HTTP POST, DoH, canary documents. The data is always fake.
Attempts to upload a synthetic-PII canary to Dropbox, Google Drive, OneDrive, an anonymous file drop and a paste site, using deliberately invalid credentials so nothing can be stored anywhere. What is measured is whether the request reaches the service and whether the body is inspected on the way out.
macOS Linux Windows network
Issues a burst of long, high-entropy subdomain lookups under a controlled zone — the shape of data being smuggled out inside DNS queries. The data encoded in the labels is a fixed benchmark marker, not anything from this host.
macOS Linux Windows network
Resolves a known-bad test domain through public DNS-over-HTTPS resolvers instead of the host's configured resolver, to establish whether DNS filtering can simply be walked around by any application that speaks HTTPS.
macOS Linux Windows network
POSTs the synthetic-PII canary to a controlled endpoint over both HTTPS and plain HTTP, so content inspection can be told apart from destination filtering: identical bodies to the same host on two protocols, where only the unencrypted one is inspectable by a proxy without interception.
macOS Linux Windows network
Writes documents whose content is what data-loss-prevention rules look for — Luhn-valid but unissued test card numbers, national-ID-shaped strings, API-key-shaped strings and a private-key block — and watches whether anything reacts to the content rather than the filename.
macOS Linux Windows
Cloud metadata services, credential files and consumer storage uploads.
Checks for a reachable Docker or containerd socket (which is root on the host), a mounted Kubernetes service-account token, container membership, and credential-bearing CI environment variables. Read-only: no container is created and no token value is read.
macOS Linux Windows
Requests instance credentials from the link-local metadata service at 169.254.169.254 for AWS, Azure and GCP, including the token-free IMDSv1 path that turns any request-forgery bug into stolen cloud keys. Only whether each endpoint answered is recorded, never any credential.
macOS Linux Windows network
Whether scan databases, exploit archives, breach data and anonymisers are reachable at all. Here blocked is the good outcome.
Resolves and fetches browser-based web proxies and consumer VPN clients. Each service is tested twice — the hostname is resolved and the landing page is fetched — because DNS filtering and URL filtering are different controls. Nothing is downloaded and no query is run.
macOS Linux Windows network
Resolves and fetches exploit-DB, Packet Storm and Vulners: public archives of working exploit code. Each service is tested twice — the hostname is resolved and the landing page is fetched — because DNS filtering and URL filtering are different controls. Nothing is downloaded and no query is run.
macOS Linux Windows network
Resolves and fetches vx-underground, MalShare and Malware Traffic Analysis: live samples and campaign captures. Each service is tested twice — the hostname is resolved and the landing page is fetched — because DNS filtering and URL filtering are different controls. Nothing is downloaded and no query is run.
macOS Linux Windows network
Resolves and fetches deHashed, Intelligence X and Have I Been Pwned: searchable credential and leak data. Each service is tested twice — the hostname is resolved and the landing page is fetched — because DNS filtering and URL filtering are different controls. Nothing is downloaded and no query is run.
macOS Linux Windows network
Resolves and fetches kali image mirrors, Metasploit, Cobalt Strike and implant hardware vendors. Each service is tested twice — the hostname is resolved and the landing page is fetched — because DNS filtering and URL filtering are different controls. Nothing is downloaded and no query is run.
macOS Linux Windows network
Resolves and fetches shodan, Censys, ZoomEye, GreyNoise, FOFA, LeakIX and Onyphe: searchable indexes of every reachable service on the internet. Each service is tested twice — the hostname is resolved and the landing page is fetched — because DNS filtering and URL filtering are different controls. Nothing is downloaded and no query is run.
macOS Linux Windows network
Calls Shodan's keyless endpoint, which returns this host's public IP address, and then its host-lookup API with a deliberately invalid key. Reaching the API means anything on this machine can query internet-wide scan data, including what Shodan already knows about this organisation's own perimeter. The public IP is hashed, never recorded.
macOS Linux Windows network
Resolves and fetches long-running hacking forums, a standard web-filter category. Each service is tested twice — the hostname is resolved and the landing page is fetched — because DNS filtering and URL filtering are different controls. Nothing is downloaded and no query is run.
macOS Linux Windows network
Removable media: whether writing to a USB device is allowed, logged or stopped.
Writes an EICAR file, a synthetic-PII canary, an autorun descriptor and a plain control file to a removable drive named by --usb-target, then reads them back and deletes them. Tests device control, removable-media scanning and DLP on removable media, which posture collection cannot answer. There is no default target: without --usb-target the test skips rather than guessing at a drive that might hold real data.
macOS Linux Windows --i-understand
Severity is how serious the behaviour would be if it were real, not how likely it is to be caught. Category follows the report schema, so a category here is the same category on the statistics pages.
A test marked --i-understand changes machine state or
fetches real offensive tooling, and will not run without explicit consent. The two marked
irreversible additionally need
--allow-irreversible, because deleting shadow copies and clearing an event log
cannot be undone by a revert plan.
Everything else reverts itself. Anything that changes state outside its sandbox writes down how to undo the change before making it, so the supervisor can restore the machine even when the worker process is killed mid-test — which, for this product, is a successful result rather than a failure.
Generated from the client registry at release time (make catalogue), which is the
same registry securitycheck --list prints. --explain shows exactly
what a given command would run, contact and change without running any of it, and
--list-targets prints every outbound destination the suite can ever reach.