katbert 3 Posted March 4, 2019 Share Posted March 4, 2019 Is it possible to send known threats to EDTD? It my test environment I extracted files mimikatz_trunk.zip. Almost all files was deleted by on-access protection. In ESMC console I go to Threats and select "thread resolved" filter. I see detected mimikatz modules. I selected one of modules and opened Threat Details. I see Threat name = Win64/Riskware.Mimikatz.D Action taken = cleaned by deleting Scanner = Real-time file system protection In the bottom of Threat Details page I press Send file to EDTD button, and see message of creating client task. One minute ago I see in Client tasks\Eset security product\send file to edtd, and this task was finished successfully But in Submitted files list in ESMC console I don't see this file. And in local interface of File Security - I don't see this file too. Is it bug in ESMC console, or submitting 100%-known threats is not possible? Link to comment Share on other sites More sharing options...
Administrators Marcos 5,228 Posted March 4, 2019 Administrators Share Posted March 4, 2019 I think it should work, at least it's possible to manually submit any file from Endpoint's gui. Will try to test it myself. Link to comment Share on other sites More sharing options...
ESET Staff MartinK 383 Posted March 4, 2019 ESET Staff Share Posted March 4, 2019 2 hours ago, Marcos said: I think it should work, at least it's possible to manually submit any file from Endpoint's gui. Will try to test it myself. My guess is that file is actually not uploaded in case it has already known hash, but this is not communicated to user and that is why it seems like file has been uploaded... Link to comment Share on other sites More sharing options...
katbert 3 Posted March 4, 2019 Author Share Posted March 4, 2019 1 hour ago, MartinK said: My guess is that file is actually not uploaded in case it has already known hash, but this is not communicated to user and that is why it seems like file has been uploaded... This is a bug or by-design? In EDTD help described upload of EICAR test file (100%-known malware) https://help.eset.com/edtd/en-US/?submit_esmc.html Link to comment Share on other sites More sharing options...
Recommended Posts