Packaging and container evasion matrix

packaging_evasion_matrix

Wraps one payload (the EICAR test file) in twenty different containers and encodings — nested ZIPs from one to ten layers deep, a password-protected ZIP, tar/gzip, base64/hex/ROT13, an NTFS alternate data stream, mark-of-the-web, and filename tricks — to find the exact point where the scanner stops looking.

Severity medium how bad it would be if it were real

Expected outcome Something should notice

Platforms 3 macOS, Linux, Windows

Isolation subprocess runs in its own process, so a kill is a measurement

What it needs before it will run

runs in --safe
Observation only. It runs even in the inert mode, because it changes nothing and sends nothing.

Gates are cumulative and none of them is implied by another: see the three gates for why they are separate decisions.

ATT&CK techniques it exercises

MITRE ATT&CK techniques this test maps to.
Technique	Name	Tactic	Across public reports
T1027	Obfuscated Files or Information	Defense Evasion	coverage statistics
T1027.002	Software Packing	Defense Evasion	coverage statistics
T1027.013	Encrypted/Encoded File	Defense Evasion	coverage statistics
T1553.005	Mark-of-the-Web Bypass	Defense Evasion	coverage statistics

How often anything notices

Not enough data: fewer than 3 public reports have run this test, so no rate is published for it. Groups below that threshold are withheld everywhere on the site — with one or two contributors an average is one organisation's result with a percent sign after it.

Other detection-test strings tests

Other tests in the Detection-test strings category.
Test	What it does	Severity
Extended signature battery signature_extended_battery	Writes a wider set of public, inert detection-test material — EICAR in several encodings and document wrappers, offensive-tooling command strings, web…	low
Known signature string battery signature_string_battery	Writes a set of public, inert detection-test strings (EICAR, GTUBE, Microsoft's AMSI test sample, credential-dumping command text, UTF-16 EICAR) and r…	low

the whole catalogue this test in the list run it yourself

Catalogue generated from client 0.1.0. A test's behaviour can change between releases; this page describes the version named here.