Difference between ML\PE and MAL\PE?

Question

Hi, 
 In our clients environments, they get two types of alerts in Central dashboard, one with MAL\PE and ML\PE. As per my understanding, MAL\PE is a definite malware infected file and ML\PE is a potentially malicious file detected by deep learning with possibility of false positive. Is this correct ? Can MAL\PE also have false positives or is the file surely infected as it has matched with a signature.

Gowtham Mani · Accepted Answer

Hi Kandarp Desai1, 
 ML\PE - This detection is generated by Sophos Intercept X&rsquo;s Machine Learning (ML) engine, also referred to by the specific Sophos approach Deep Learning and is designed to detect malicious PE (Portable Executable) files such as .exe, .sys, .dll, .scr 
 MAl\PE - This detection is for generic detection of malware but using the available signature and not the Deep Learning. 
 We may or may not have False positives in both the cases and neither of them can be concluded as a False positive by the naming. If you believe any of the samples detected under these to be False positive, you can submit the sample to Sophos Labs for confirmation.