Testing Endpoint Threat Prevention - Jamf Protect Evaluation Guide

Jamf Protect Evaluation Guide
Solution
Application
Content Type
Technical Documentation
Utilities & Services
ft:locale
en-US

To test endpoint threat prevention, you can create a script that leverages the anti-malware test file from EICAR. For more information, go to the Anti Malware Test File webpage on the EICAR website.

Requirements

  • A supported version of macOS installed on the device. (See Jamf Protect Requirements)

  • A plan with the Endpoint Threat Prevention Options setting configured to Block and Report.

Note:

If using a virtual machine, take a snapshot to revert back to at the end of this simulation.

Testing threat prevention with unrestricted Internet access

  1. Open Terminal and run these commands in the provided order.

    # Download eicar from the EICAR website to your Desktop
curl -o ~/Desktop/eicar -s -O "https://secure.eicar.org/eicar.com" 2>&1

# Make the file an executable
chmod +x ~/Desktop/eicar

# Execute the file
zsh ~/Desktop/eicar

  2. Open the EICAR executable on your Desktop. An alert appears stating that the software has been blocked.

Note:

If you cannot run the above simulation due to network restrictions, follow the steps below.

Testing Threat Prevention with restricted Internet access

  1. Open Terminal and run the following commands to make the script executable.

    # Base64 decode eicar to your Desktop
EICAR_CONTENT='WDVPIVAlQEFQWzRcUFpYNTQoUF4pN0NDKTd9JEVJQ0FSLVNUQU5EQVJELUFOVElWSVJVUy1URVNULUZJTEUhJEgrSCo='
 
echo "${EICAR_CONTENT}" | /usr/bin/base64 --decode > ~/Desktop/eicar 2>&1

# Make the file an executable 
chmod +x ~/Desktop/eicar

# Execute the file
zsh ~/Desktop/eicar

  2. Open the eicar executable on your Desktop. An alert appears stating that the software has been blocked.

To test additional detection with additional macOS malware threats, see the Mac Malware page from the Objective-See website.