natecbh/fileless-maltest repository overview

⁠🔬 EICAR Memory Injection Test Container

This container provides a secure sandbox environment to test memory-based EICAR injection against real-time security solutions (AV/EDR/HIPS). It simulates in-memory process injection using Linux /proc/[pid]/mem interface and validates if your security stack can detect such behavior.

⁠🧪 What It Does

This tool performs:

• 📂 Launching a benign process (sleep 60)
• 🗺️ Mapping its memory layout via /proc/[pid]/maps
• 💉 Injecting the EICAR⁠ test string into writable memory regions
• 🔍 Verifying the injection by reading memory back
• ⏰ Waiting for detection (e.g., AV alerts, EDR flags)

⁠🚀 Usage

⁠🔧 Prerequisites

• Docker must be installed
• Container must be run with --privileged (to access /proc/[pid]/mem)

⁠▶️ Run the Container

docker run --rm -it --privileged \
  --name eicar-injector \
  natecbh/fileless-maltest:1.0

⁠🐚 Inside the Container

Once inside, the script will:

1. Launch a dummy target process (sleep 60)
2. Analyze writable memory regions
3. Attempt to inject EICAR string into selected memory region
4. Verify injection by reading back the data
5. Pause for 15 seconds to allow detection by AV/EDR/HIPS

You will be prompted before injection begins.

⁠🛡️ Security Expectations

⁠⚠️ Disclaimer

This container is intended for legitimate security testing purposes only.

• The EICAR test string is not malicious — it is a standard harmless AV test signature.
• Do not run this container on production systems.
• Use only in isolated test environments (e.g., VM, sandbox).

⁠🔐 Technical Notes

• The script relies on sleep as a benign target process.
• It uses /proc/[pid]/maps and /proc/[pid]/mem for memory introspection and writing.
• You must run with root privileges inside the container.