Zero-day malware stream scanning NEW

Zero-day malware stream scanning enables real-time delivery of malware IOCs (Indicators of Compromise) to FortiGate devices using the fortimq daemon and notifications.

FortiGate automatically maintains an up-to-date malware hash database, removing outdated entries and optimizing performance without manual intervention.

A FortiSandbox Advanced (FSAC) or FortiSandbox Advanced Plus (FSAP) license is required for FortiGate to receive malware hash updates.

This topic includes the following information:

• Enabling fortimq daemon and notifications

• How FortiGate receives malware-hash updates

• Example 1: blocking malicious files on HTTP protocol

• Example 2: monitoring malicious files on MAPI protocol

• Troubleshooting commands

Enabling fortimq daemon and notifications

The fortimq deamon can be enabled in the CLI and requires the following configuration:

• FortiGuard Anycast must be enabled.

• Cloud communications must be enabled.

• Notifications must be enabled.

To enable fortimq daemon in the CLI:

1. Enable fortimq daemon:

   config system fortiguard
      set fortiguard-anycast enable   
   end
   config system global
       set cloud-communication enable
   end

2. Enable notifications:

   config system fortiguard   
      set subscribe-update notification enable
   end

3. Confirm FortiGate is connected to fortimq daemon and able to receive messages:

   # diagnose test application fortimq  1
   connection status: connected
       acct: 901713
       fqdn: globalfortimq.fortinet.net
       port: 5671
       next-channel: 2
       msg count: 46266
       attempts: 0

How FortiGate receives malware-hash updates

In this example, FGT_A is configured to use post-transfer scanning to FortiGate Cloud Sandbox to monitor for malware. FGT_B is configured to use zero-day malware stream scanning and receive messages through fortimq daemon.

This example uses a sample malicious file with the hash value 71e4d6a0cc41d47e49ac0eeb45a26b2afefdd920538078eeda89b0c8f01bf622.

The user on Client1, downloads a malicious file, and FGT_A submits the file to FortiGate Cloud Sandbox for analysis. FortiGate Cloud Sandbox determines the file is malicious, and sends the verdict to FGT_A. FGT_B also receives the malware-hash update from fortimg daemon. Following is a summary of this process:

1. FGT_A generates a log for the submission to FortiGate Cloud Sandbox:

   1: date=2025-03-25 time=14:06:39 eventtime=1742936798824763123 tz="-0700" logid="0201009233" type="utm" subtype="virus" eventtype="analytics" level="information" vd="vdom1" policyid=1 poluuid="f820fc12-f07d-51ef-10a7-9ce92adafc22" policytype="policy" msg="File submitted to Sandbox." action="analytics" service="HTTP" sessionid=2176 srcip=10.1.100.201 dstip=192.241.205.137 srcport=33454 dstport=80 srccountry="Reserved" dstcountry="United States" srcintf="port2" srcintfrole="lan" dstintf="port3" dstintfrole="lan" srcuuid="eb7a7402-4489-51ef-4afd-ca286e50ca04" dstuuid="eb7a7402-4489-51ef-4afd-ca286e50ca04" proto=6 direction="incoming" filename="fsa_downloader_1bf622.exe" filetype="exe" url="http://rb3.ftnt.io/downloader/0.21385215657678536" profile="fgt_a_analytics_submit" agent="Wget/1.20.3 (linux-gnu)" httpmethod="GET" analyticscksum="71e4d6a0cc41d47e49ac0eeb45a26b2afefdd920538078eeda89b0c8f01bf622" analyticssubmit="true"

2. FGT_A receives the verdict from FortiGate Cloud Sandbox:

   1: date=2025-03-25 time=14:12:13 eventtime=1742937133549596694 tz="-0700" logid="0201009238" type="utm" subtype="virus" eventtype="analytics" level="notice" vd="vdom1" srcip=10.1.100.201 dstip=192.241.205.137 srcport=33454 dstport=80 action="monitored" service="HTTP" filename="fsa_downloader_1bf622.exe" fsaverdict="high risk" analyticscksum="71e4d6a0cc41d47e49ac0eeb45a26b2afefdd920538078eeda89b0c8f01bf622" dtype="fortisandbox"

3. FGT_B receives the malware-hash update from fortimq daemon within one minute and adds the new value to the scanunit file-has list.

   # diagnose sys scanunit file-hash query sha256 71e4d6a0cc41d47e49ac0eeb45a26b2afefdd920538078eeda89b0c8f01bf622
   0-day malware-stream '71e4d6a0cc41d47e49ac0eeb45a26b2afefdd920538078eeda89b0c8f01bf622' description 'FSA/RISK_HIGH|FSA3KET320000157|7609597837562012709'

Example 1: blocking malicious files on HTTP protocol

In this example, zero-day malware stream scanning is enabled on FGT_B and set to block and log malicious files on the HTTP protocol. The configuration includes:

• Enabling fortimq daemon and notifications. See Enabling fortimq daemon and notifications.

• Configuring an AntiVirus profile to use zero-day malware stream scanning to block malicious files

To configure an AntiVirus profile in the GUI:

1. Go to Security Profiles > AntiVirus, and click Create New.

2. Set the following options:

   • Enter a name, such as block_0_day.

   • Enable AntiVirus scan and select Monitor.

   • Set Feature set to Proxy-based.

   • Enable HTTP.

   • Enable Use 0-day malware stream scanning and select Block.

   • Set the other options as desired.

   

3. Click OK to save the profile.

To configure an AntiVirus profile in the CLI:

config antivirus profile
    edit "block_0_day"
        set feature-set proxy
        config http
            set av-scan monitor
            set malware-stream block
        end
    next
end

When the user on Client2 attempts to download a malicious file, FGT_B blocks the file and displays the HTTP block replacement message:

FGT_B adds the block action to the security event logs:

• In the GUI, go to Log & Report > Security Events:

  

• In the CLI:

  1: date=2025-03-25 time=14:14:40 eventtime=1742937280529792875 tz="-0700" logid="0210008244" type="utm" subtype="virus" eventtype="0-day-malware-stream" level="warning" vd="vdom1" policyid=1 poluuid="fdd6254c-09a5-51f0-537c-7cbbf7b452fa" policytype="policy" msg="Blocked by 0-day malware stream." action="blocked" service="HTTP" sessionid=5921 srcip=10.1.100.252 dstip=192.241.205.137 srcport=50448 dstport=80 srccountry="Reserved" dstcountry="United States" srcintf="port1" srcintfrole="undefined" dstintf="port9" dstintfrole="undefined" srcuuid="b97d1360-09a5-51f0-7394-2ac219c6ac54" dstuuid="b97d1360-09a5-51f0-7394-2ac219c6ac54" proto=6 direction="incoming" filename="fsa_downloader_1bf622.exe" quarskip="Quarantine-disabled" virus="FSA/RISK_HIGH|FSA3KET320000157|7609597837562012709" viruscat="File Hash" dtype="0-day-malware-stream" itype="0-day-malware-stream" filehash="71e4d6a0cc41d47e49ac0eeb45a26b2afefdd920538078eeda89b0c8f01bf622" url="http://rb3.ftnt.io/downloader/0.21385215657678536" profile="block_0_day" agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0" httpmethod="GET" analyticssubmit="false

Example 2: monitoring malicious files on MAPI protocol

In this example, zero-day malware stream scanning is enabled on FGT_B and set to monitor and log malicious files on the MAPI protocol. The configuration includes:

• Enabling fortimq daemon and notifications. See Enabling fortimq daemon and notifications.

• Configuring an AntiVirus profile to use zero-day malware stream scanning and monitor malicious files

To configure an AntiVirus profile in the GUI:

1. Go to Security Profiles > AntiVirus, and click Create New.

2. Set the following options:

   • Enter a name, such as monitor_0_day.

   • Enable AntiVirus scan and select Monitor.

   • Set Feature set to Proxy-based.

   • Enable MAPI.

   • Enable Use 0-day malware stream scanning and select Monitor.

   • Set the other options as desired.

   

3. Click OK to save the profile.

To configure FGT_B in the CLI:

config antivirus profile
    edit "monitor_0_day"
        set feature-set proxy
        config mapi
            set av-scan monitor
            set malware-stream monitor
        end
    next
end

When the user on Client2 receives an email through MAPI protocol, FGT_B adds the monitored action to the security event logs:

• In the GUI, go to Log & Report > Security Events:

  

• In the CLI:

  1: date=2025-03-25 time=14:53:50 eventtime=1742939630098052082 tz="-0700" logid="0210008245" type="utm" subtype="virus" eventtype="0-day-malware-stream" level="notice" vd="vdom1" policyid=1 poluuid="fdd6254c-09a5-51f0-537c-7cbbf7b452fa" policytype="policy" msg="Detected by 0-day malware stream." action="monitored" service="MAPI" sessionid=6797 srcip=10.1.100.252 dstip=172.16.200.200 srcport=50616 dstport=443 srccountry="Reserved" dstcountry="Reserved" srcintf="port1" srcintfrole="undefined" dstintf="port9" dstintfrole="undefined" srcuuid="b97d1360-09a5-51f0-7394-2ac219c6ac54" dstuuid="b97d1360-09a5-51f0-7394-2ac219c6ac54" proto=6 direction="incoming" filename="malware_stream_sample" quarskip="Quarantine-disabled" virus="FSA/RISK_HIGH|FSA3KET320000157|7609597837562012709" viruscat="File Hash" dtype="0-day-malware-stream" itype="0-day-malware-stream" filehash="71e4d6a0cc41d47e49ac0eeb45a26b2afefdd920538078eeda89b0c8f01bf622" profile="block_0_day" from="\"av_user2@ftntqa.com\" <av_user2@ftntqa.com>" to="\"Antivirus  User1\" <av_user1@ftntqa.com>" sender="\"av_user2@ftntqa.com\" <av_user2@ftntqa.com>" recipient="\"Antivirus  User1\" <av_user1@ftntqa.com>" subject="test Tue, 25 Mar 2025 21:53:44 +0000" attachment="yes" analyticssubmit="false"

Troubleshooting commands

The following diagnose commands can be used for troubleshooting:

# diagnose test application fortimq <level>

Level	Description
1	fortimq status
2	dump ipc links
3	dump bindings
4	dump queue info
5	dump dns info
6	dump state info
7	dump timer info
8	dump unbound payloads
9	dump amqp client errors
99	restart fortimq daemon