How can we test Sandstorm? Will there be a link on Sophostest.com to an innocuous file that will trigger a scan?
How can we test Sandstorm? Will there be a link on Sophostest.com to an innocuous file that will trigger a scan?
---
Sophos UTM 9.3 Certified Engineer
Tim Grantham
Enterprise Architect & Business owner
Exe files are easier to trigger than documents. Almost all exe under 10MB will trigger sandstorm, however almost all of those will return clean. Try downloading a windows system tweaker, registry editor, virtual cd drive, etc. Those are more likely to have suspicious behavior.
==
When in doubt, Script it out.
i am trying to test this aswell and get very unsatisfactory results (i am still keeping in mind that this is a beta)
i was able to download most (but not all) links from malshare
this was neither ran through Sophos Sandstorm nor detected by dual scan.
this way either sandstorm is not working (i dont see any upload on the sandstorm statistic) or that file was not suspicious enough?
---
Sophos UTM 9.3 Certified Engineer