Jump to content

Known threats and EDTD


katbert
 Share

Recommended Posts

Is it possible to send known threats to EDTD?

It my test environment I extracted files mimikatz_trunk.zip. Almost all files was deleted by on-access protection. In ESMC console I go to Threats and select "thread resolved" filter. I see detected mimikatz modules. I selected one of modules and opened Threat Details. I see

Threat name = Win64/Riskware.Mimikatz.D
Action taken  =  cleaned by deleting
Scanner = Real-time file system protection

In the bottom of Threat Details page I press Send file to EDTD button, and see message of creating client task.

One minute ago I see in Client tasks\Eset security product\send file to edtd, and this task was finished successfully

But in Submitted files list in ESMC console I don't see this file. And in local interface of File Security - I don't see this file too.

Is it bug in ESMC console, or submitting 100%-known threats is not possible?

 

Link to comment
Share on other sites

  • Administrators

I think it should work, at least it's possible to manually submit any file from Endpoint's gui. Will try to test it myself.

Link to comment
Share on other sites

  • ESET Staff
2 hours ago, Marcos said:

I think it should work, at least it's possible to manually submit any file from Endpoint's gui. Will try to test it myself.

My guess is that file is actually not uploaded in case it has already known hash, but this is not communicated to user and that is why it seems like file has been uploaded...

Link to comment
Share on other sites

1 hour ago, MartinK said:

My guess is that file is actually not uploaded in case it has already known hash, but this is not communicated to user and that is why it seems like file has been uploaded...

This is a bug or by-design?

In EDTD help described upload of EICAR test file (100%-known malware)

https://help.eset.com/edtd/en-US/?submit_esmc.html

Link to comment
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...