sophos's Introduction

malice-sophos

Malice Sophos AntiVirus Plugin

This repository contains a Dockerfile of Sophos for Docker's trusted build published to the public DockerHub.

Dependencies

ubuntu:bionic (84.1 MB)

Installation

Install Docker.
Download trusted build from public DockerHub: docker pull malice/sophos

Usage

docker run --rm malice/sophos EICAR

Or link your own malware folder:

$ docker run --rm -v /path/to/malware:/malware:ro malice/sophos FILE

Usage: sophos [OPTIONS] COMMAND [arg...]

Malice Sophos AntiVirus Plugin

Version: v0.1.0, BuildTime: 20180903

Author:
  blacktop - <https://github.com/blacktop>

Options:
  --verbose, -V          verbose output
  --elasticsearch value  elasticsearch url for Malice to store results [$MALICE_ELASTICSEARCH_URL]
  --table, -t            output as Markdown table
  --callback, -c         POST results to Malice webhook [$MALICE_ENDPOINT]
  --proxy, -x            proxy settings for Malice webhook endpoint [$MALICE_PROXY]
  --timeout value        malice plugin timeout (in seconds) (default: 60) [$MALICE_TIMEOUT]
  --help, -h             show help
  --version, -v          print the version

Commands:
  update  Update virus definitions
  web     Create a Sophos scan web service
  help    Shows a list of commands or help for one command

Run 'sophos COMMAND --help' for more information on a command.

This will output to stdout and POST to malice results API webhook endpoint.

Sample Output

JSON

{
  "sophos": {
    "infected": true,
    "result": "EICAR-AV-Test",
    "engine": "5.27.0",
    "database": "5.35",
    "updated": "20170123"
  }
}

Markdown

Sophos

Infected	Result	Engine	Updated
true	EICAR-AV-Test	5.27.0	20170123

Documentation

Issues

Find a bug? Want more features? Find something missing in the documentation? Let me know! Please don't hesitate to file an issue.

CHANGELOG

See CHANGELOG.md

Contributing

See all contributors on GitHub.

Please update the CHANGELOG.md and submit a Pull Request on GitHub.

License

sophos's People

Contributors

Stargazers

Watchers

sophos's Issues

Scan result is wrong

hi, comparison of sophos results and virustotal results:

docker run --rm -v /tmp/scanfile:/malware:ro malice/sophos:updated 012b1d09dd3c0a50e028c24c8daf908b5f69eceb 
{"sophos":{"infected":false**,"result":""**,"engine":"5.74.0","database":"5.77","updated":"20200831"}}

Below is the result of virustotal：
"Sophos": {
"category": "malicious",
"engine_name": "Sophos",
"engine_update": "20200505",
"engine_version": "4.98.0",
"method": "blacklist",
"result": "Mal/Generic-S"
},

After sophos is updated, the engine version is higher than that of vt. Why can't sophos find the virus?

Json results

hi, i'm attempting to run my own documents through the scanner and it appears the file name never shows are the result. instead it just say result":"" any tips on how to change this?

Recommend Projects