Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 998595" data-attributes="member: 32260">The suffix !cl does not mean &quot;cloud&quot;, but it is a specific category:[URL unfurl=&quot;false&quot;]https://docs.microsoft.com/en-us/microsoft-365/security/intelligence/malware-naming?view=o365-worldwide[/URL]The detection with !cl suffix can happen when scanning the system, for example:[URL unfurl=&quot;false&quot;]https://gitlab.com/gitlab-org/gitlab-runner/-/issues/2544[/URL]The !ml suffix means machine learning. When cloud-delivered protection works, the file can besometimes uploaded to the cloud backend and after creating the fast detection it is downloaded to the client machine. Next, Defender can block the file/process by using this behavior-based detection. I do not know if the detection was done with or without the cloud backend, so I asked for the link to the test.[URL unfurl=&quot;false&quot;]https://www.microsoft.com/security/blog/2017/07/18/windows-defender-antivirus-cloud-protection-service-advanced-real-time-defense-against-never-before-seen-malware/[/URL]</blockquote>

[QUOTE="Andy Ful, post: 998595, member: 32260"] The suffix !cl does not mean "cloud", but it is a specific category: [URL unfurl="false"]https://docs.microsoft.com/en-us/microsoft-365/security/intelligence/malware-naming?view=o365-worldwide[/URL] The detection with !cl suffix can happen when scanning the system, for example: [URL unfurl="false"]https://gitlab.com/gitlab-org/gitlab-runner/-/issues/2544[/URL] The !ml suffix means machine learning. When cloud-delivered protection works, the file can be sometimes uploaded to the cloud backend and after creating the fast detection it is downloaded to the client machine. Next, Defender can block the file/process by using this behavior-based detection. I do not know if the detection was done with or without the cloud backend, so I asked for the link to the test. [URL unfurl="false"]https://www.microsoft.com/security/blog/2017/07/18/windows-defender-antivirus-cloud-protection-service-advanced-real-time-defense-against-never-before-seen-malware/[/URL] [/QUOTE]

Verification