Endpoint Protection

I have seen a few Heur.AdvML detections lately on SEP 12.1 clients. When was this machine learning engine introduced in SEP 12.1? I was under Impression that machine learning would't be introduced until SEP 14?

It's a heuristic detection so it is apart of SONAR.

"Heur.AdvML.C is a heuristic detection designed to generically detect malicious files using advanced machine learning technology

https://www.symantec.com/security_response/writeup.jsp?docid=2016-051813-2926-99

I just recently began to see thes detections. Maybe SONAR has been silently improved with parts of SEP 14 technology? 

 

.

Yes, I'm aware of the verbiage but it also states it detects files using machine learning, not using machine learning to make detections/convictions. It can be read a few ways but I digress.

There are things happening on the backend, especially with ATP. It very well could be in preparation for 14 but as far as I know anything with heuristics in 12.1 is from SONAR/BASH.

Hi TORB,

Just out of curiousity, which logs are you seeing these in?  And were they blocking or "log only"?

Many thanks in advance,

Mick

Hi Mick

They were listed in the Risk monitor alerts logs and also sent as regular email risk notification. 

Most where qurantined,  some "left alone". All of them false positives. 

Insight was not used, and no Hash was associated with the "threats".

Seems to have been limitied to between 19-22 august. 

Torb