Endpoint Detection & Response - Testing Behavioral Detections

  • Katelyn Husvar
  • EF

Before You Begin

  • Ensure that the Avert Library Item has behavioral detections enabled and has been successfully applied to the device by confirming that a green dot is visible next to the Avert Library Item located within the Status tab of a Device Record.

Testing Behavioral Detections

  1. Open Terminal.

  2. Run the following command to trigger a behavioral event.

    cp 'X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*'

Results in Detect Mode

When the Behavior Posture Mode in the Avert Library Item is set to Detect mode:

  • EDR will identify the test as malicious behavioral activity. This will be reported with a status of Detected in both the Threats module (accessible via the left-hand navigation bar) and the Threats tab within a Device Record.

Results in Protect Mode

When the Behavior Posture Mode in the Avert Library Item is set to Protect mode:

  • EDR will recognize the test as malicious activity and block it. This will be reflected with a status of Blocked in both the Threats module (accessible via the left-hand navigation bar) and the Threats tab within a Device Record.