You might want to check one vendors explanation on their detection engines: https://labsblog.f-secure.com/2016/05/17/whats-the-deal-with...