Threat Protection Tests
Download industry-standard test signatures (EICAR + reference patterns) to verify your gateway antivirus (AV) and endpoint protection (EPP) are operational.
Your NGFW must have SSL Inspection (DPI-SSL) enabled on this domain to inspect downloads over HTTPS.
Advanced Threat Samples
Test beyond EICAR — validate heuristic engines, exploit detection, and ransomware behavior analysis.
Advanced samples temporarily removed for compliance review
Heuristic malware samples, OLE ActiveX exploit documents, and ransomware behavior simulators are being relocated to dedicated security research infrastructure that complies with our hosting provider's acceptable-use policies for malware-pattern content.
The replacement samples will offer the same heuristic, exploit, and ransomware-behavior detection validation — delivered under proper compliance controls including explicit user consent and dedicated infrastructure for security research traffic.
Learn more about this tool
Free Malware Test Files & Threat Protection Validator
Verify that your antivirus, Endpoint Protection Platform (EPP), Endpoint Detection & Response (EDR), or gateway antivirus (AV) solutions are actively scanning and blocking threats. ITSecTools provides safe, benign test files that trigger security detection signatures without performing any real malicious actions.
Available Test Files
- EICAR Standard Test File — The industry-standard antivirus detection string, available in .com, .txt, and .zip formats. Recognized by every major AV engine worldwide.
- Heuristic Malware Simulators — Polymorphic signature patterns in .exe, .pdf, and .doc formats that test behavioral analysis engines beyond simple signature matching.
- Ransomware Behavior Script — A .vbs script simulating file encryption behavior to verify your ransomware protection policies and behavioral detection capabilities.
All test files are generated on-demand and delivered over HTTPS. If your security solution blocks the download, it confirms your protection is working correctly. No real malicious code is involved — these are detection-only test payloads designed for security validation.