What is a false negative?
A false negative is a malicious file that a security tool fails to detect. The scanner looks at the file, decides it is clean, and lets it stay on the server.
It is the opposite of a false positive, where a clean, legitimate file is wrongly flagged as malware.
| The file is malicious | The file is clean |
Flagged as malware | True positive | False positive |
Not flagged | False negative | True negative |
No malware scanner catches 100% of threats. Attackers constantly change and obfuscate their code to evade detection. False negatives are common with:
New or zero-day malware that has not been seen before
Heavily obfuscated or encoded PHP, JavaScript, or other scripts
Malicious code injected into otherwise legitimate files, such as a plugin or theme file
Phishing kits, spam mailers, and backdoors disguised as normal site files
A false negative is more dangerous than a false positive because the threat stays active: a webshell keeps giving attackers access, or a phishing page keeps collecting credentials.
When you find malware on a server protected by Monarx that was not detected, sending us the sample helps our Threat Research team improve detection for you and for every other server running Monarx.
How to send us the sample
There are two ways to submit a file Monarx missed. Both send the file directly to the Monarx Cloud for review by our Threat Research team.
Option 1: Upload form in the Monarx WebApp
This is the easiest option if you already have a copy of the file on your computer.
Log in to the Monarx WebApp and go to https://app.monarx.com/upload.
Drag and drop the file into the upload box, or click the upload icon and select the file.
Click Submit.
Option 2: The monarx-sample-upload command on the server
This is the best option when the file is on a server running the Monarx Agent, because you do not need to download it first. The monarx-sample-upload script is installed in /usr/bin/ together with the agent.
Upload a file:
monarx-sample-upload /home/user/public_html/wp-content/uploads/suspicious.php
Upload a file with a note for our team (recommended):
monarx-sample-upload /home/user/public_html/wp-content/uploads/suspicious.php --note "False negative: webshell not detected"
A successful upload returns:
Sample uploaded successfully
To submit several files, run the command once per file.
Troubleshooting the upload command
Error | Cause | Fix |
|
| Install it with |
| DNS or network issue | Check that the server can resolve and reach |
| Temporary issue on the Monarx side | Wait a few minutes and try again; if it keeps failing, use the WebApp upload form |
Tips for a useful submission
Submit the original file. Do not clean, edit, or rename it before uploading, so we analyze exactly what was on the server.
Add context with
--note. For example: where the file was found, what it was doing (sending spam, redirecting visitors, phishing), and how you found it.Include related files. If the malware was spread across several files, such as a loader and a payload, submit each one.
Do not submit files with customer personal data or credentials unless they are part of the malicious code.
What happens next?
Once the sample reaches the Monarx Cloud, our Threat Research team reviews it. If it is malicious, we update our detection so it is caught on your servers and across the Monarx network. Please allow 1-2 business days to receive feedback.
To follow up on a submission, log in to https://app.monarx.com and open a support request using the chat widget in the bottom-right corner of the screen. Include the file name, the server where it was found, and the date you submitted it.