Why did hosts get infected if the endpoint protection product has a signature for that malware?

Question

Multiple hosts were attempting CNC communication that is specific to a threat from at least 2013, H-worm.

However, endpoint protection is deployed on these hosts and functioning but no malicious files were recently detected. The endpoint protection product is even specified in the malware's CNC. But this threat is very old and my vendor seems to have signatures for it. I queried some file hashes (from the FireEye article I linked above) in VirusTotal to see if my vendor detects them and it does. Scheduled antivirus scans were also running as they should but nothing was detected.

My main question is, why did the endpoint protection miss these infections?

Right now I have 3 guesses:

1. A product malfunction has taken place and I need to contact my vendor;
2. There exist (new?) instances of H-worm that are not detected by my vendor
3. These infections are not reflected in endpoint protection logs for some legitimate reason

Answer 1

Anti-malware software can have exclusions of files with certain extensions or exclude certain drives or directories from scanning. If the malware is located in a location excluded for scanning, the software will not identify, quarantine or remove the offending software.

You can have a look through the software configuration for such exclusions. If you know where the worm is located, you could run a parallel test by placing the eicar test file in that folder and see if that is identified. If the software is scanning the infected location and is not finding the worm or eicar, the software is not fit for purpose.