An admin downloaded and installed metasploit framework on a Linux Server with Intercept-X installed.
Nothing happened from the Sophos side.
I expected it to detect and alert at least a PUA we then need to whitelist.
As a further test I did a download of metasploit framework for windows on a windows machine. Sophos Firewall did not detect any threat. Further I did not install metasploit but did the right click scan with Sophos EP.
Nothing happened again.
I think it's strange that you allow a tool that can pentest your internal network without any notice.
Linux Server:
Windows EP:
Metasploit should be an entry under Application Control category: "Network monitoring / Vulnerability tool". So you should be able to block it there.
If the definition no longer detects the file, you can submit it via: FileSubmission (sophos.com) so the data is updated.
At least on Windows, when running the Metasploit installer, it attempts to drop Eicar.com under "C:\metasploit\apps\pro\data\eicar\" as a way to check you have excluded the directory from real-time scanning. So that should be detected as a minimum unless you have excluded the install directory?
If I install the version found here:Downloads by Version | Metasploit Documentation Penetration Testing Software, Pen Testing Securitywith only a real-time exclusion, if i scan the directory I get plenty of detections....
C:\metasploit\apps\pro\data\eicar\eicar.com belongs to virus/spyware 'EICAR-AV-Test' C:\metasploit\apps\pro\data\exe_templates\template_x86_windows.exe belongs to virus/spyware 'Generic Reputation PUA' C:\metasploit\apps\pro\data\meterpreter\ext_server_pivot.x64.dll belongs to virus/spyware 'Generic Reputation PUA' C:\metasploit\apps\pro\data\meterpreter\ext_server_pivot.x86.dll belongs to virus/spyware 'Generic Reputation PUA' C:\metasploit\apps\pro\data\exe_templates\pro\template_x86_windows.exe belongs to virus/spyware 'Generic Reputation PUA' C:\metasploit\apps\pro\ui\config\build\installer\eicar\eicar.com belongs to virus/spyware 'EICAR-AV-Test' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\eicar.com belongs to virus/spyware 'EICAR-AV-Test' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\vncdll.x64.dll belongs to virus/spyware 'Harmony Loader' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\vncdll.x86.dll belongs to virus/spyware 'Harmony Loader' C:/metasploit/apps/pro/vendor/bundle/ruby/3.0.0/gems/metasploit-framework-6.2.29/data/exploits/CVE-2008-5353.jar/msf/x/AppletX.class belongs to virus/spyware 'Troj/ClsLdr-Gen' C:/metasploit/apps/pro/vendor/bundle/ruby/3.0.0/gems/metasploit-framework-6.2.29/data/exploits/CVE-2008-5353.jar/msf/x/LoaderX.class belongs to virus/spyware 'Troj/ClsLdr-Gen' C:/metasploit/apps/pro/vendor/bundle/ruby/3.0.0/gems/metasploit-framework-6.2.29/data/exploits/CVE-2008-5353.jar/msf/x/PayloadX.class belongs to virus/spyware 'Mal/JavaKC-B' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\CVE-2008-5499.swf belongs to virus/spyware 'Troj/ExpSWF-B' C:/metasploit/apps/pro/vendor/bundle/ruby/3.0.0/gems/metasploit-framework-6.2.29/data/exploits/CVE-2009-3867.jar/AppletX.class belongs to virus/spyware 'Troj/Clsldr-U' C:/metasploit/apps/pro/vendor/bundle/ruby/3.0.0/gems/metasploit-framework-6.2.29/data/exploits/CVE-2009-3869.jar/AppletX.class belongs to virus/spyware 'Mal/JavaKC-M' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\CVE-2010-1297.swf belongs to virus/spyware 'Troj/SWFDlr-V' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\CVE-2011-0609.swf belongs to virus/spyware 'Troj/SWFExp-CC' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\CVE-2011-0611.swf belongs to virus/spyware 'Exp/20110611-A' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\CVE-2011-2110.swf belongs to virus/spyware 'Troj/SWFDlr-AS' C:/metasploit/apps/pro/vendor/bundle/ruby/3.0.0/gems/metasploit-framework-6.2.29/data/exploits/CVE-2012-0507.jar/msf/x/Exploit.class belongs to virus/spyware 'Mal/Generic-S' C:/metasploit/apps/pro/vendor/bundle/ruby/3.0.0/gems/metasploit-framework-6.2.29/data/exploits/CVE-2012-0507.jar/msf/x/PayloadX.class belongs to virus/spyware 'Mal/JavaKC-B' C:/metasploit/apps/pro/vendor/bundle/ruby/3.0.0/gems/metasploit-framework-6.2.29/data/exploits/CVE-2012-0507.jar/msf/x/Help.class belongs to virus/spyware 'Mal/ExpJava-W' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\CVE-2012-0754.swf belongs to virus/spyware 'Troj/ExpSWF-B' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\CVE-2012-1723.jar belongs to virus/spyware 'Mal/ExpJava-N' C:/metasploit/apps/pro/vendor/bundle/ruby/3.0.0/gems/metasploit-framework-6.2.29/data/exploits/CVE-2012-1723.jar/cve1723/Attacker.class belongs to virus/spyware 'Mal/JavaGen-D' C:/metasploit/apps/pro/vendor/bundle/ruby/3.0.0/gems/metasploit-framework-6.2.29/data/exploits/CVE-2012-1723.jar/cve1723/ConfusingClassLoader.class belongs to virus/spyware 'Mal/JavaGen-D' C:/metasploit/apps/pro/vendor/bundle/ruby/3.0.0/gems/metasploit-framework-6.2.29/data/exploits/CVE-2012-1723.jar/cve1723/Confuser.class belongs to virus/spyware 'Troj/JavaDl-NZ' C:/metasploit/apps/pro/vendor/bundle/ruby/3.0.0/gems/metasploit-framework-6.2.29/data/exploits/CVE-2012-1723.jar/msf/x/PayloadX$StreamConnector.class belongs to virus/spyware 'Mal/JavaKC-H' C:/metasploit/apps/pro/vendor/bundle/ruby/3.0.0/gems/metasploit-framework-6.2.29/data/exploits/CVE-2012-1723.jar/msf/x/PayloadX.class belongs to virus/spyware 'Mal/JavaKC-B' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\cve-2014-1761.rtf belongs to virus/spyware 'Exp/20141761-A' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\evasion_shellcode.js belongs to virus/spyware 'Troj/JSInj-B' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\hta_evasion.hta belongs to virus/spyware 'ATK/MSFEva-A' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\post\bypassuac-x64.exe belongs to virus/spyware 'Mal/Generic-R' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\post\bypassuac-x86.dll belongs to virus/spyware 'Mal/Swrort-AO' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\post\SharpHound.exe belongs to virus/spyware 'BloodHoundAD' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\templates\template_armle_darwin.bin belongs to virus/spyware 'OSX/GetShell-J' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\templates\template_ppc_darwin.bin belongs to virus/spyware 'OSX/Swrort-AX' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\templates\template_x64_darwin.bin belongs to virus/spyware 'OSX/Getshell-E' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\templates\template_x64_windows.dll belongs to virus/spyware 'ATK/FatRat-J' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\templates\template_x64_windows_dccw_gdiplus.dll belongs to virus/spyware 'Troj/Meter-F' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\templates\template_x64_windows_mixed_mode.dll belongs to virus/spyware 'Mal/Generic-S' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\templates\template_x86_darwin.bin belongs to virus/spyware 'OSX/Getshell-BA' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\templates\template_x86_windows.dll belongs to virus/spyware 'ATK/FatRat-J' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\templates\template_x86_windows_mixed_mode.dll belongs to virus/spyware 'Mal/Generic-S' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\templates\template_x86_windows_svc.exe belongs to virus/spyware 'Serv Inject' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\android\meterpreter.dex belongs to virus/spyware 'Android Metasploit' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\elevator.x64.debug.dll belongs to virus/spyware 'Troj/Meterpre-J' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\elevator.x64.dll belongs to virus/spyware 'Generic Reputation PUA' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\elevator.x86.debug.dll belongs to virus/spyware 'Troj/Meterpre-J' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\elevator.x86.dll belongs to virus/spyware 'Mal/Generic-S' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\ext_server_bofloader.x64.debug.dll belongs to virus/spyware 'Generic Reputation PUA' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\ext_server_bofloader.x64.dll belongs to virus/spyware 'Generic Reputation PUA' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\ext_server_bofloader.x86.debug.dll belongs to virus/spyware 'Generic Reputation PUA' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\ext_server_bofloader.x86.dll belongs to virus/spyware 'Generic Reputation PUA' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\ext_server_espia.x64.debug.dll belongs to virus/spyware 'Generic Reputation PUA' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\ext_server_espia.x64.dll belongs to virus/spyware 'Generic Reputation PUA' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\ext_server_espia.x86.debug.dll belongs to virus/spyware 'Generic Reputation PUA' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\ext_server_espia.x86.dll belongs to virus/spyware 'Generic Reputation PUA' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\ext_server_extapi.x64.debug.dll belongs to virus/spyware 'Generic Reputation PUA' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\ext_server_extapi.x64.dll belongs to virus/spyware 'Generic Reputation PUA' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\ext_server_extapi.x86.debug.dll belongs to virus/spyware 'Generic Reputation PUA' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\ext_server_extapi.x86.dll belongs to virus/spyware 'Generic Reputation PUA' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\ext_server_incognito.x64.debug.dll belongs to virus/spyware 'Generic Reputation PUA' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\ext_server_incognito.x64.dll belongs to virus/spyware 'Generic Reputation PUA' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\ext_server_incognito.x86.debug.dll belongs to virus/spyware 'Generic Reputation PUA' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\ext_server_incognito.x86.dll belongs to virus/spyware 'Generic Reputation PUA' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\ext_server_kiwi.x64.debug.dll belongs to virus/spyware 'Mal/Generic-S' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\ext_server_kiwi.x64.dll belongs to virus/spyware 'Mal/Generic-S' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\ext_server_kiwi.x86.debug.dll belongs to virus/spyware 'Generic Reputation PUA' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\ext_server_kiwi.x86.dll belongs to virus/spyware 'Generic Reputation PUA' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\ext_server_lanattacks.x64.debug.dll belongs to virus/spyware 'Generic Reputation PUA' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\ext_server_lanattacks.x64.dll belongs to virus/spyware 'Generic Reputation PUA' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\ext_server_lanattacks.x86.debug.dll belongs to virus/spyware 'Generic Reputation PUA' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\ext_server_lanattacks.x86.dll belongs to virus/spyware 'Generic Reputation PUA' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\ext_server_peinjector.x64.debug.dll belongs to virus/spyware 'Generic Reputation PUA' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\ext_server_peinjector.x64.dll belongs to virus/spyware 'Generic Reputation PUA' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\ext_server_peinjector.x86.debug.dll belongs to virus/spyware 'Generic Reputation PUA' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\ext_server_peinjector.x86.dll belongs to virus/spyware 'Generic Reputation PUA' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\ext_server_powershell.x64.debug.dll belongs to virus/spyware 'Generic Reputation PUA' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\ext_server_powershell.x64.dll belongs to virus/spyware 'Generic Reputation PUA' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\ext_server_powershell.x86.debug.dll belongs to virus/spyware 'Generic Reputation PUA' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\ext_server_powershell.x86.dll belongs to virus/spyware 'Generic Reputation PUA' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\ext_server_priv.x64.debug.dll belongs to virus/spyware 'Generic Reputation PUA' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\ext_server_priv.x64.dll belongs to virus/spyware 'Generic Reputation PUA' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\ext_server_priv.x86.debug.dll belongs to virus/spyware 'Generic Reputation PUA' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\ext_server_priv.x86.dll belongs to virus/spyware 'Generic Reputation PUA' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\ext_server_python.x64.debug.dll belongs to virus/spyware 'Generic Reputation PUA' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\ext_server_python.x64.dll belongs to virus/spyware 'Generic Reputation PUA' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\ext_server_python.x86.debug.dll belongs to virus/spyware 'Generic Reputation PUA' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\ext_server_python.x86.dll belongs to virus/spyware 'Generic Reputation PUA' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\ext_server_sniffer.x64.dll belongs to virus/spyware 'Generic Reputation PUA' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\ext_server_sniffer.x86.dll belongs to virus/spyware 'Generic Reputation PUA' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\ext_server_stdapi.x64.debug.dll belongs to virus/spyware 'Generic Reputation PUA' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\ext_server_stdapi.x64.dll belongs to virus/spyware 'Generic Reputation PUA' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\ext_server_stdapi.x86.debug.dll belongs to virus/spyware 'Generic Reputation PUA' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\ext_server_stdapi.x86.dll belongs to virus/spyware 'Generic Reputation PUA' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\ext_server_unhook.x64.debug.dll belongs to virus/spyware 'Generic Reputation PUA' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\ext_server_unhook.x64.dll belongs to virus/spyware 'Generic Reputation PUA' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\ext_server_unhook.x86.debug.dll belongs to virus/spyware 'Generic Reputation PUA' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\ext_server_unhook.x86.dll belongs to virus/spyware 'Generic Reputation PUA' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\ext_server_winpmem.x64.debug.dll belongs to virus/spyware 'Generic Reputation PUA' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\ext_server_winpmem.x64.dll belongs to virus/spyware 'Generic Reputation PUA' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\ext_server_winpmem.x86.debug.dll belongs to virus/spyware 'Generic Reputation PUA' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\ext_server_winpmem.x86.dll belongs to virus/spyware 'Generic Reputation PUA' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\meterpreter.py belongs to virus/spyware 'ATK/Meter-V' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\metsrv.x64.debug.dll belongs to virus/spyware 'Generic Reputation PUA' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\metsrv.x64.dll belongs to virus/spyware 'Generic Reputation PUA' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\metsrv.x86.debug.dll belongs to virus/spyware 'Mal/Behav-010' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\metsrv.x86.dll belongs to virus/spyware 'Mal/Behav-010' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\screenshot.x64.debug.dll belongs to virus/spyware 'Troj/Meterpre-I' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\screenshot.x64.dll belongs to virus/spyware 'Troj/Meterpre-I' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\screenshot.x86.debug.dll belongs to virus/spyware 'Troj/Meterpre-I' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\meterpreter\screenshot.x86.dll belongs to virus/spyware 'Troj/Meterpre-I' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\cve-2010-0094\Exploit$1$1.class belongs to virus/spyware 'Mal/JavaKC-S' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\cve-2010-0094\Exploit$1.class belongs to virus/spyware 'Mal/JavaKC-F' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\cve-2010-0094\Exploit$2.class belongs to virus/spyware 'Mal/JavaImr-C' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\cve-2010-0094\Exploit.class belongs to virus/spyware 'Mal/JavaKC-P' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\cve-2010-0094\PayloadClassLoader.class belongs to virus/spyware 'Mal/JavaCL-C' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\CVE-2010-0232\kitrap0d.x86.dll belongs to virus/spyware 'Mal/Swrort-L' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\CVE-2010-0842\MixerMidiApplet.class belongs to virus/spyware 'Mal/JavaMid-D' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\cve-2010-4452\AppletX.class belongs to virus/spyware 'Mal/JavaCL-C' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\cve-2011-3544\Exploit.class belongs to virus/spyware 'Troj/JavaDl-FO' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\CVE-2012-1535\Main.swf belongs to virus/spyware 'Exp/20121535-A' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\CVE-2012-4681\Exploit.class belongs to virus/spyware 'Mal/JavaExpl-D' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\cve-2012-5076\Exploit.class belongs to virus/spyware 'Exp/20125076-A' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\cve-2013-0074\SilverApp1.dll belongs to virus/spyware 'Mal/Generic-R' C:/metasploit/apps/pro/vendor/bundle/ruby/3.0.0/gems/metasploit-framework-6.2.29/data/exploits/cve-2013-0074/SilverApp1.xap/SilverApp1.dll belongs to virus/spyware 'Mal/Generic-R' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\CVE-2013-0109\nvidia_nvsvc.x86.dll belongs to virus/spyware 'Mal/Swrort-L' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\cve-2013-1300\schlamperei.x86.dll belongs to virus/spyware 'Mal/Swrort-AO' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\CVE-2013-2465\Exploit.class belongs to virus/spyware 'Exp/20132465-A' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\cve-2013-3660\ppr_flatten_rec.x86.dll belongs to virus/spyware 'Mal/Swrort-L' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\CVE-2013-5045\CVE-2013-5045.dll belongs to virus/spyware 'Mal/Generic-R' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\CVE-2013-5331\Exploit.swf belongs to virus/spyware 'Troj/ExpSWF-B' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\CVE-2014-0257\CVE-2014-0257.dll belongs to virus/spyware 'Mal/Generic-R' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\CVE-2014-0322\AsXploit.swf belongs to virus/spyware 'Troj/SWFExp-DB' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\CVE-2014-0497\Vickers.swf belongs to virus/spyware 'Troj/SWFExp-CZ' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\CVE-2014-0515\msf.swf belongs to virus/spyware 'Troj/SWFExp-LL' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\CVE-2014-0556\msf.swf belongs to virus/spyware 'Troj/SWFExp-LL' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\CVE-2014-0569\msf.swf belongs to virus/spyware 'Troj/SWFExp-LL' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\CVE-2014-4113\cve-2014-4113.x64.dll belongs to virus/spyware 'Harmony Loader' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\CVE-2014-4113\cve-2014-4113.x86.dll belongs to virus/spyware 'Mal/Swrort-L' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\CVE-2014-8440\msf.swf belongs to virus/spyware 'Troj/SWFExp-LL' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\CVE-2015-0016\cve-2015-0016.dll belongs to virus/spyware 'Harmony Loader' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\CVE-2015-0311\msf.swf belongs to virus/spyware 'Troj/SWFExp-LL' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\CVE-2015-0313\msf.swf belongs to virus/spyware 'Troj/SWFExp-LL' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\CVE-2015-0336\msf.swf belongs to virus/spyware 'Troj/SWFExp-LL' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\CVE-2015-0359\msf.swf belongs to virus/spyware 'Troj/SWFExp-LL' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\CVE-2015-1701\cve-2015-1701.x64.dll belongs to virus/spyware 'Harmony Loader' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\CVE-2015-1701\cve-2015-1701.x86.dll belongs to virus/spyware 'Mal/Swrort-L' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\CVE-2015-2426\reflective_dll.x64.dll belongs to virus/spyware 'Harmony Loader' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\CVE-2015-3090\msf.swf belongs to virus/spyware 'Troj/SWFExp-LL' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\CVE-2015-3105\msf.swf belongs to virus/spyware 'Troj/SWFExp-LL' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\CVE-2015-3113\msf.swf belongs to virus/spyware 'Troj/SWFExp-LL' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\CVE-2015-3673\exploit.daplug belongs to virus/spyware 'OSX/20153673-A' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\CVE-2015-5119\msf.swf belongs to virus/spyware 'Troj/SWFExp-LD' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\CVE-2016-0040\CVE-2016-0040.x64.dll belongs to virus/spyware 'Harmony Loader' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\cve-2016-0051\cve-2016-0051.x86.dll belongs to virus/spyware 'Harmony Loader' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\cve-2016-0189\ieshell32.dll belongs to virus/spyware 'Troj/20160189-A' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\CVE-2016-4655\exploit belongs to virus/spyware 'OSX/Swrort-AX' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\CVE-2018-0824\UnmarshalPwn.exe belongs to virus/spyware 'Mal/Swrort-AO' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\CVE-2018-4237\ssudo belongs to virus/spyware 'OSX/Lotoor-C' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\CVE-2018-8440\ALPC-TaskSched-LPE.dll belongs to virus/spyware 'Mal/Swrort-AO' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\CVE-2018-8453\CVE-2018-8453.exe belongs to virus/spyware 'Mal/Swrort-AO' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\cve-2018-8897\reflective_dll.x64.dll belongs to virus/spyware 'Mal/Swrort-AO' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\CVE-2019-0808\exploit.dll belongs to virus/spyware 'Mal/Swrort-AO' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\cve-2019-1322\CVE-2019-1322-EXE.exe belongs to virus/spyware 'Mal/Swrort-AO' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\CVE-2019-1458\exploit.dll belongs to virus/spyware 'Harmony Loader' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\CVE-2020-0787\CVE-2020-0787.x64.dll belongs to virus/spyware 'Harmony Loader' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\CVE-2020-0787\CVE-2020-0787.x86.dll belongs to virus/spyware 'Harmony Loader' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\CVE-2020-0796\CVE-2020-0796.x64.dll belongs to virus/spyware 'Harmony Loader' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\CVE-2020-1048\cve-2020-1048-exe.Win32.exe belongs to virus/spyware 'Mal/Swrort-AO' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\CVE-2020-1048\cve-2020-1048-exe.x64.exe belongs to virus/spyware 'Mal/Swrort-AO' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\CVE-2020-1054\exploit.dll belongs to virus/spyware 'Harmony Loader' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\cve-2020-1313\cve-2020-1313-exe.x64.exe belongs to virus/spyware 'Mal/Swrort-AO' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\CVE-2020-17136\cloudFilterEOP.exe belongs to virus/spyware 'Mal/Generic-S' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\CVE-2021-21551\CVE-2021-21551.x64.dll belongs to virus/spyware 'Harmony Loader' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\CVE-2021-40449\CVE-2021-40449.x64.dll belongs to virus/spyware 'Harmony Loader' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\CVE-2022-21882\CVE-2022-21882.x64.dll belongs to virus/spyware 'Harmony Loader' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\CVE-2022-26904\CVE-2022-26904.dll belongs to virus/spyware 'Harmony Loader' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\CVE-2022-34918\ubuntu.elf belongs to virus/spyware 'Mal/Generic-S' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\dell_protect\dell_protect.x64.dll belongs to virus/spyware 'Mal/Swrort-AO' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\drunkpotato\drunkpotato.x64.dll belongs to virus/spyware 'Mal/Swrort-AO' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\drunkpotato\drunkpotato.x86.dll belongs to virus/spyware 'Mal/Swrort-AO' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\juicypotato\juicypotato.x64.dll belongs to virus/spyware 'ATK/JPotato-B' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\juicypotato\juicypotato.x86.dll belongs to virus/spyware 'ATK/JPotato-B' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\ntapphelpcachecontrol\exploit.dll belongs to virus/spyware 'Harmony Loader' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\office_word_macro\vbaProject.bin belongs to virus/spyware 'ATK/FatRat-F' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\powershell\powerdump.ps1 belongs to virus/spyware 'ATK/Nishang-I' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\powershell\powerfun.ps1 belongs to virus/spyware 'ATK/PowerFun-A' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\rottenpotato\rottenpotato.x64.dll belongs to virus/spyware 'ATK/RPotato-A' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\rottenpotato\rottenpotato.x86.dll belongs to virus/spyware 'ATK/RPotato-A' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\tpwn\tpwn belongs to virus/spyware 'OSX/tpwn-A' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\uso_trigger\uso_trigger.x64.dll belongs to virus/spyware 'Harmony Loader' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\uso_trigger\uso_trigger.x86.dll belongs to virus/spyware 'Harmony Loader' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\post\execute-dotnet-assembly\HostingCLRx64.dll belongs to virus/spyware 'Harmony Loader' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\post\powershell\SharpHound.ps1 belongs to virus/spyware 'BloodHoundAD' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\android\apk\AndroidManifest.xml belongs to virus/spyware 'Andr/Bckdr-RXK' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\android\apk\classes.dex belongs to virus/spyware 'Andr/Bckdr-RXM' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-payloads-2.0.101\data\java\metasploit\Payload.class belongs to virus/spyware 'ATK/JMeter-A' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit_payloads-mettle-1.0.20\build\aarch64-iphone-darwin\bin\mettle belongs to virus/spyware 'OSX/Swrort-AX' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit_payloads-mettle-1.0.20\build\aarch64-iphone-darwin\bin\mettle.dylib belongs to virus/spyware 'OSX/Swrort-AX' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit_payloads-mettle-1.0.20\build\aarch64-iphone-darwin\bin\mettle.sha1.dylib belongs to virus/spyware 'OSX/Swrort-AX' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit_payloads-mettle-1.0.20\build\aarch64-iphone-darwin\bin\sniffer belongs to virus/spyware 'OSX/Swrort-AX' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit_payloads-mettle-1.0.20\build\aarch64-linux-musl\bin\mettle belongs to virus/spyware 'Linux/Swrort-G' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit_payloads-mettle-1.0.20\build\aarch64-linux-musl\bin\mettle.bin belongs to virus/spyware 'Mal/Generic-S' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit_payloads-mettle-1.0.20\build\arm-iphone-darwin\bin\mettle belongs to virus/spyware 'OSX/Swrort-AX' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit_payloads-mettle-1.0.20\build\arm-iphone-darwin\bin\mettle.dylib belongs to virus/spyware 'OSX/Swrort-AX' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit_payloads-mettle-1.0.20\build\arm-iphone-darwin\bin\mettle.sha1.dylib belongs to virus/spyware 'OSX/Swrort-AX' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit_payloads-mettle-1.0.20\build\arm-iphone-darwin\bin\sniffer belongs to virus/spyware 'iPh/Swrort-BA' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit_payloads-mettle-1.0.20\build\armv5b-linux-musleabi\bin\mettle belongs to virus/spyware 'Linux/Swrort-H' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit_payloads-mettle-1.0.20\build\armv5b-linux-musleabi\bin\mettle.bin belongs to virus/spyware 'Mal/Generic-S' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit_payloads-mettle-1.0.20\build\armv5l-linux-musleabi\bin\mettle belongs to virus/spyware 'Linux/Swrort-H' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit_payloads-mettle-1.0.20\build\armv5l-linux-musleabi\bin\mettle.bin belongs to virus/spyware 'Mal/Generic-S' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit_payloads-mettle-1.0.20\build\i486-linux-musl\bin\mettle belongs to virus/spyware 'Linux/Swrort-G' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit_payloads-mettle-1.0.20\build\i486-linux-musl\bin\mettle.bin belongs to virus/spyware 'Mal/Generic-S' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit_payloads-mettle-1.0.20\build\i686-w64-mingw32\bin\mettle.exe belongs to virus/spyware 'Mal/Generic-S' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit_payloads-mettle-1.0.20\build\mips-linux-muslsf\bin\mettle.bin belongs to virus/spyware 'Mal/Generic-S' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit_payloads-mettle-1.0.20\build\mips64-linux-muslsf\bin\mettle.bin belongs to virus/spyware 'Mal/Generic-S' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit_payloads-mettle-1.0.20\build\mipsel-linux-muslsf\bin\mettle.bin belongs to virus/spyware 'Mal/Generic-S' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit_payloads-mettle-1.0.20\build\powerpc-e500v2-linux-musl\bin\mettle belongs to virus/spyware 'Linux/Swrort-G' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit_payloads-mettle-1.0.20\build\powerpc-e500v2-linux-musl\bin\mettle.bin belongs to virus/spyware 'Mal/Generic-S' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit_payloads-mettle-1.0.20\build\powerpc-linux-muslsf\bin\mettle belongs to virus/spyware 'Linux/Swrort-G' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit_payloads-mettle-1.0.20\build\powerpc-linux-muslsf\bin\mettle.bin belongs to virus/spyware 'Mal/Generic-S' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit_payloads-mettle-1.0.20\build\powerpc64le-linux-musl\bin\mettle belongs to virus/spyware 'Linux/Swrort-G' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit_payloads-mettle-1.0.20\build\powerpc64le-linux-musl\bin\mettle.bin belongs to virus/spyware 'Mal/Generic-S' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit_payloads-mettle-1.0.20\build\s390x-linux-musl\bin\mettle.bin belongs to virus/spyware 'Mal/Generic-S' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit_payloads-mettle-1.0.20\build\x86_64-apple-darwin\bin\mettle belongs to virus/spyware 'OSX/Swrort-AX' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit_payloads-mettle-1.0.20\build\x86_64-apple-darwin\bin\sniffer belongs to virus/spyware 'OSX/Swrort-AX' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit_payloads-mettle-1.0.20\build\x86_64-linux-musl\bin\mettle belongs to virus/spyware 'Linux/Swrort-G' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit_payloads-mettle-1.0.20\build\x86_64-linux-musl\bin\mettle.bin belongs to virus/spyware 'Mal/Generic-S' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit_payloads-mettle-1.0.20\build\x86_64-w64-mingw32\bin\mettle.exe belongs to virus/spyware 'Mal/Generic-S' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\evasion\windows\process_herpaderping\ProcessHerpaderpingTemplate_x64.exe belongs to virus/spyware 'ATK/TurtleLd-Q' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\evasion\windows\process_herpaderping\ProcessHerpaderpingTemplate_x86.exe belongs to virus/spyware 'ATK/TurtleLd-Q' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\evasion\windows\process_herpaderping\ProcessHerpaderping_x64.exe belongs to virus/spyware 'ATK/Herpaderp-A' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\evasion\windows\process_herpaderping\ProcessHerpaderping_x86.exe belongs to virus/spyware 'ATK/Herpaderp-A' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\cve-2010-0840\vuln\Exploit$1.class belongs to virus/spyware 'Mal/JavaKC-H' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\cve-2010-0840\vuln\Exploit.class belongs to virus/spyware 'Mal/JavaKC-H' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\modules\exploits\windows\ftp\ftpshell_cli_bof.rb belongs to virus/spyware 'Exp/20187573-A' C:\metasploit\apps\pro\vendor\bundle\ruby\3.0.0\gems\metasploit-framework-6.2.29\data\exploits\CVE-2013-3906\word\media\image1.jpeg belongs to virus/spyware 'Exp/20133906-A'
Thanks for your reply 930!
Application control could be something we may consider about those pentesting tools. Do you know how thex work? Simply file names or hashes? That would be too easy to manipulate.
On the linux server using metasploit after installation works without issues. Still nothing from Sophos EP.
Eicar viruses have been placed on the disk with the installation of MS framework on the Linux machine.
In terms of scanning, the Sophos Protection Linux agent currently only has on-demand scanning. The Runtime detection plugin works based off of the MITRE attack matrix in terms of reporting detections in Sophos Central.
App Control to block specific apps is primarily data rules provided by Labs. They are hopefully generic enough to detect v1, v2, v3, the installer and the apps but occasionally they require updates. The form I linked to is the best bet to get the latest version updated in the rules.
As for the Linux product, from the installer page there is reference to a Sophos Anti-Virus for Linux (Legacy) product which did have real-time scanning but is being retired.
==
Sophos Anti-Virus for Linux (Legacy) is not supported after 20 July 2023. Please see here for more details.
I've read here a while ago that Linux XDR should get some extra features after Sophos aquired some Linux AV company.
But it so silent around it, it looks someone at Sophos Mgmt even forgot that they have this product. The Sales guys of course count one XDR license for something that does provides 0 protection currently.
Qoosh said:The Runtime detection plugin works based off of the MITRE attack matrix in terms of reporting detections in Sophos Central.
can you please translate that? Should there be detections in Central Management?
Looks like it's in "Threat Analysis Center - Detections", If you use CIXA Server license without XDR, you can't see that section.
Nothing is in Detections about it. Not even MDR Team discovered and reported that. Should'nt they rund frequent scans on all systems.
You can see in a screenshot above, that XDR is installed (and licensed) on that box.
That's low performance currently.
Runtime Detection???
does this feature really do something?
Can move eicar files around on the server without any issue. Nothing reported in central, though.
root@Ubuntu2204LTS:~# cat /home/localuser/eicar.comX5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*root@Ubuntu2204LTS:~# rm /home/localuser/eicar.comroot@Ubuntu2204LTS:~# cp /opt/metasploit-framework/embedded/framework/data/eicar.com /home/localuser/root@Ubuntu2204LTS:~# ls -l /home/localuser/total 12-rwxr-xr-x 1 root root 68 Jan 31 14:23 eicar.com-rwxr-xr-x 1 root root 6034 Dec 6 08:41 msfinstall
Could you try the following steps to see if anything changes when moving around the eicar file?