CIS-10.1 Deploy and Maintain Anti-Malware Software

• T1027 Obfuscated Files or Information — Anti-malware software can detect and quarantine malicious files or commands that use encoding, packing, encryption, or other obfuscation techniques to evade detection. • T1027.002 Software Packing — Packed executables are a common malware delivery method. Modern anti-malware engines unpack or emulate packed binaries during scanning, making this a direct technical capability of the safeguard. • T1055 Process Injection — Some anti-malware products monitor cross-process memory writes, remote-thread creation, process hollowing, and similar injection behavior. Where these protections are enabled, the safeguard directly detects or blocks process injection. • T1059.001 PowerShell — Anti-malware integrates with PowerShell logging and AMSI to inspect scripts and commands before execution, making PowerShell malware a primary detection target. • T1059.005 Visual Basic — Malicious VBScript is routinely inspected by anti-malware through script scanning and behavioral analysis prior to execution. • T1204.002 Malicious File — Anti-malware can scan a file when it is opened or executed and quarantine or block the file before the malicious payload runs. This directly reduces the effectiveness of malicious files that depend on user execution. • T1547.006 Kernel Modules and Extensions — Anti-malware products may detect malicious kernel drivers or unsigned modules during installation or loading. However, preventing unauthorized kernel module loading relies more heavily on platform integrity and driver enforcement controls (anti-malware product monitors and blocks malicious kernel modules, drivers, or extensions) than standard anti-malware alone.