Knowledgebase

Overview

This article provides step-by-step instructions for verifying that Sentinel Anti-malware detection and automatic quarantine features are operating correctly. The standard industry practice for validating anti-malware systems is to deploy the EICAR test file, a harmless string specifically engineered to trigger security software without introducing actual malware.

Prerequisites

• SSH or terminal access to the server hosting the target domain.
• A valid domain hosted on the server with an accessible document root directory.
• Administrative privileges required to modify file ownership and execute system scans.

Downloading and Configuring the EICAR Test File

Before initiating detection or quarantine tests, deploy the EICAR test file to a domain's document root and adjust its permissions. Sentinel Anti-malware is configured to ignore files owned by root:root by default.

// change to a domain hosted on your server
cd /var/www/vhosts/example.com/httpdocs/

// download the test malware
wget http://www.eicar.org/download/eicar.com.txt

// change the ownership to the domain owner user 
chown example:psacln eicar.com.txt

Testing Anti-Malware Detection

1. Navigate to the target domain's document root directory.
2. Deploy the EICAR test file using the commands provided above.
3. Execute a manual malware scan on the domain. For detailed instructions, refer to: https://www.danami.com/clients/knowledgebase/168/How-do-I-run-a-malware-scan-using-Sentinel-Anti-malware.html
4. Review the scan report to confirm that the EICAR test file is identified and flagged.

Testing Automatic Quarantine

To verify automatic quarantine functionality, ensure the feature is enabled prior to testing. Configuration details are available here: https://www.danami.com/clients/knowledgebase/165/How-can-I-enable-automatic-qurantine-using-Sentinal-Anti-malware.html

1. Confirm that automatic quarantine is enabled within the Sentinel configuration.
2. Deploy the EICAR test file to the domain's /httpdocs/ directory and adjust ownership as outlined above.
3. If real-time monitoring is enabled: The system should automatically detect and relocate the file to the quarantine area immediately upon upload or permission modification.
4. If real-time monitoring is disabled: Manually trigger a malware scan on the domain. Refer to: https://www.danami.com/clients/knowledgebase/168/How-do-I-run-a-malware-scan-using-Sentinel-Anti-malware.html
5. Verify that the file has been successfully moved to the quarantine directory.

Troubleshooting

• File not detected during scan: Verify that file ownership was changed from root:root to the domain owner. Sentinel Anti-malware explicitly bypasses files owned by root.
• Quarantine action not triggered: Confirm that both automatic quarantine and real-time monitoring are enabled in the Sentinel settings. If real-time monitoring is disabled, a manual scan must be executed to process detections.
• Scan reports missing entries: Ensure the EICAR file was successfully downloaded and placed directly within the /httpdocs/ directory before initiating the scan sequence.