It's important to make sure that your products remain up to date with the latest virus content and the GTI File Reputation Cloud Service is correctly configured. Also, make sure that the endpoints can communicate with the GTI Cloud Service.
To receive email notification when this article is updated, click Subscribe on the right side of the page. You must be logged on to subscribe.
Contents
Click to expand the section you want to view:
The ENS for Windows 10.6.1/10.7.0 September 2021 Update and later use GTI-REST by default. GTI File Reputation requires that the computer communicate with the GTI Cloud Service directly using the internet or indirectly using a proxy server. It's vital to verify that endpoints can communicate with the GTI Cloud Service to make sure that the endpoint can use the GTI reputation services. GTI services are a critical part of malware detections.
Use Curl.exe or PowerShellto verify whether the endpoint can connect to the GTIserver.
To test with PowerShell if there isn't a proxy server, use the following command:
tnc amcore-ens.rest.gti.trellix.com -port 443
You see a response similar to the following if there's connectivity to the GTI server:
GTI File Reputation requires that the computer communicate with the GTI server directly using Domain Name System (DNS) or indirectly using an internal DNS that forwards the DNS request to mcafee.com. It's vital to verify that endpoints can communicate with the GTI server to make sure that the endpoint remains up to date. For more information, see KB53782 - Global Threat Intelligence and split Domain Name System (DNS).
Use nslookupto verify whether the endpoint can connect to the GTIserver.
Press Windows+R, type cmd, and click OK.
Type or paste nslookup sfqpit75pjh525siewar2dtgt5.avts.mcafee.com and press Enter.
You see a response similar to the following if there's connectivity to the GTI server:
The ENS 10.6.1/10.7.0 September 2021 Update and later use GTI-REST by default. To test GTI, use the password-protected Rest-GTI-Artemis-test.zip file in the "Attachment" section of this article.
NOTES:
Password protection is applied to the .zip file to make sure that it isn't blocked when sent using email. Passwords normally meet higher security standards. The password is test_detectionand the MD5 is 5db32a316f079fe7947100f899d8db86.
The Rest-GTI-Artmeis-test.exe process is a test program and is harmless.
After you extract Rest-GTI-Artemis-test.exe, you can execute the file to trigger an on-access scan (OAS) on this file. The sample contains a test detection that only triggers a detection if GTI File Reputation using REST is enabled and working. The detection name Artemis!5DB32A316F07appears in the threat event.
To test GTI, use the password-protected ArtemisTest.zipfile in the "Attachment" section of this article.
NOTES:
Password protection is applied to the .zip file to make sure that it isn't blocked when sent using email. Passwords normally meet higher security standards. The password is password.
The ArtemisTest.exe process is a test program and is harmless.
After you extract ArtemisTest.exe, you can run an OAS test and an on-demand scan (ODS) test on this file.
OAS test
Make sure that ENS is running.
Open Windows Explorer and navigate to the folder that contains the test utility.
To start the program, double-click ArtemisTest.exe. If GTI File Reputation is enabled, ENS deletes the file or denies access and prevents the file from running (the action taken depends on the configuration).
Verify the contents of the DNS client through the command line and check whether the test file is passed to the GTI server.
To perform the OAS test again, double-click ArtemisTest.exe.
At the command prompt, type ipconfig /displaydnsand press Enter. This command shows all recent DNS queries made on the computer, including the queries that GTI File Reputation makes. The GTI File Reputation queries are on subdomains of avqs.mcafee.com or avts.mcafee.com.
ODS test
NOTE: To avoid an OAS detection, either exclude the file or directory or temporarily disable the OAS.
Make sure that ENS is running.
Open Windows Explorer and navigate to the folder that contains the test utility.
Right-click the folder or start an ODS through the console for ENS. If GTI is working correctly, the On-Access Scan Messages dialog (similar to below) reports that ArtemisTest.exe is detected. Depending on your settings, the test file is deleted and quarantined as malware.
OAS Messages
Message
VirusScan Alert!
Name
x:\path\Artemistest.exe
Detected As
Artemis5DB32A316F07
State
Deleted
To test GTI, use the password protected ArtemisPDF_test.pdffile in the "Attachment" section of this article.
NOTES:
Password protection is applied to the .zip file to make sure that it isn't blocked when sent using email. Passwords normally meet higher security standards. The password is password.
The ArtemisPDF_test process is a test program and is harmless.
For GTI lookups on PDF files to happen, the following conditions must be met:
