Multiple hosts were attempting CNC communication that is specific to a threat from at least 2013, H-worm.
However, endpoint protection is deployed on these hosts and functioning but no malicious files were recently detected. The endpoint protection product is even specified in the malware's CNC. But this threat is very old and my vendor seems to have signatures for it. I queried some file hashes (from the FireEye article I linked above) in VirusTotal to see if my vendor detects them and it does. Scheduled antivirus scans were also running as they should but nothing was detected.
My main question is, why did the endpoint protection miss these infections?
Right now I have 3 guesses:
- A product malfunction has taken place and I need to contact my vendor;
- There exist (new?) instances of H-worm that are not detected by my vendor
- These infections are not reflected in endpoint protection logs for some legitimate reason