Anyone recall SONAR Activity...?
The main use of SONAR is to enhance detection of zero day threats. Symantec claims SONAR can also prevent attackers from leveraging unpatched software vulnerabilities. SONAR has the ability to convict a suspicious process based on a behavioral profile. 
I'm not recalling SONAR event. Do you...?
Thanks