Antivirus is the most widely deployed control in ATT&CK, yet most teams cannot say which adversary techniques it actually blocks on their estate. MITRE ATT&CK v20 maps mitigation M1049 Antivirus/Antimalware to 23 techniques and sub-techniques, concentrated in phishing delivery, script execution and obfuscation. This guide reads that mapping as a control owner would: which techniques antivirus genuinely reduces, how to configure it so it keeps doing so, the technique classes it was never designed to stop, and how to measure coverage. It is written for endpoint engineers, detection engineers and security architects. For product selection and the shift from signatures to machine learning, see the Next-Generation Antivirus (NGAV) Guide; this page does not repeat it.
Key takeaways
- Antivirus is a file and script control. Every one of the 23 ATT&CK v20 mappings concerns malicious content arriving, being unpacked or being interpreted; none concern stolen credentials or legitimate tools used legitimately.
- Script inspection matters more than file scanning. ATT&CK's own guidance for T1027 and T1027.010 points to the Antimalware Scan Interface (AMSI), which sees PowerShell, VBScript, JScript and Office VBA after deobfuscation.
- Exclusions are an attack surface. ATT&CK maps M1049 to T1564.012 File/Path Exclusions: an over-broad exclusion is a hiding place an adversary can find and use.
- Tamper resistance is part of the control. An engine that a local administrator can switch off protects nothing once the attacker has that administrator, so lock settings centrally and alert on changes.
- Measure by technique, not by agent count. Track coverage, signature age, AMSI health, exclusion count and test detonation results per platform, then fill the gaps with M1038, M1040 and identity controls.
What M1049 is in ATT&CK v20
ATT&CK defines M1049 as solutions that use signatures, heuristics and behavioural analysis to detect, block and remediate malicious software, deployed across all devices with automated updates. The mitigation text lists five measures: signature-based detection (hashes, byte sequences, command-line patterns), heuristic detection, behavioural detection, real-time scanning of files as they are accessed, downloaded or executed, and cloud-assisted threat intelligence. It also names centralised management consoles and behavioural analysis tooling as implementation tools.
D3FEND relates M1049 to three defensive techniques: D3-FH File Hashing (comparing file hashes to known malware), D3-FCR File Content Rules (pattern matching rules over file content, the family YARA belongs to) and D3-PA Process Analysis and its subclasses (observing running processes for adversary behaviour). That split is useful when you assess a product: hashing and content rules catch known and near-known samples, process analysis is where variants and fileless activity are caught.
Techniques ATT&CK says M1049 mitigates
The table lists all 23 current mappings in ATT&CK v20, grouped by tactic. "How it helps" paraphrases ATT&CK's per-technique usage text. None of the mappings are revoked or deprecated.
| Tactic | Technique | How antivirus helps (per ATT&CK) |
|---|---|---|
| Initial Access | T1566 Phishing, T1566.001 Spearphishing Attachment, T1566.003 Spearphishing via Service | Automatically quarantines suspicious attachments and files delivered through email or third-party services. |
| Execution | T1059 Command and Scripting Interpreter, T1059.001 PowerShell, T1059.005 Visual Basic, T1059.006 Python | Quarantines suspicious script files; on Windows, script content passes through AMSI before it runs. |
| Persistence, Privilege Escalation | T1547.006 Kernel Modules and Extensions | Rootkit scanners such as rkhunter and chkrootkit on Linux, with ATT&CK's caveat that rootkits may be built to evade them. See the T1547 Boot or Logon Autostart Execution Defensive Guide. |
| Lateral Movement | T1080 Taint Shared Content | Quarantines malicious files planted on shared drives and collaboration storage. |
| Stealth | T1027 Obfuscated Files or Information, T1027.009 Embedded Payloads, T1027.010 Command Obfuscation | Detection and quarantine of obfuscated files; AMSI analyses commands after they are processed or interpreted. |
| T1027.002 Software Packing, T1027.013 Encrypted/Encoded File, T1027.014 Polymorphic Code, T1027.015 Compression, T1027.016 Junk Code Insertion, T1027.012 LNK Icon Smuggling | Heuristics, high-entropy checks, recursive unpacking of archives and self-extracting files, behaviour-based and machine learning detection, custom signatures for observed samples. | |
| T1036 Masquerading, T1036.008 Masquerade File Type, T1221 Template Injection | Quarantine of files whose content does not match their claimed type; antivirus with detonation and intrusion prevention to stop documents fetching remote payloads. | |
| T1564 Hide Artifacts, T1564.012 File/Path Exclusions | Review and audit file and folder exclusions and keep their scope to the minimum required. |
Read the table for what is absent as much as what is present. There is no credential access technique, no use of valid accounts, no cloud control plane technique and no remote service abuse. That is the honest coverage profile of antivirus: it is strongest where an adversary must land a file or script that looks malicious.
How to implement M1049 so it keeps working
Deployment is the easy part. The value comes from the settings below, and from making sure they stay set. Product examples are neutral illustrations; use the equivalent setting in your own platform.
- Cover every platform you run. ATT&CK's mappings include Linux and macOS for most techniques. On macOS, Apple describes three built-in layers: prevention through the App Store or Gatekeeper with notarisation, blocking through Gatekeeper, notarisation and XProtect, and remediation by XProtect. XProtect uses YARA signatures that Apple updates separately from macOS and checks daily by default. Inventory Linux servers, build agents and container hosts as carefully as laptops.
- Turn on real-time, cloud and behaviour protection together. Signature-only engines miss T1027.014 polymorphic code by design; ATT&CK's own text says machine learning and behaviour-based detection will be more effective there.
- Make sure script hosts feed the engine. AMSI is a vendor-agnostic Windows interface: PowerShell (scripts, interactive use and dynamic evaluation), Windows Script Host, JScript and VBScript, Office VBA macros and UAC elevation all pass content to the registered antimalware product. Microsoft notes that from Windows 10 version 1903 an AMSI provider DLL that is not Authenticode-signed may not be loaded, so confirm your product's provider is registered and healthy.
- Scan archives and email at the boundary as well as the endpoint. T1027.015 Compression is explicitly about recursive unpacking and self-extracting archives; gateway scanning catches what an endpoint engine never sees on an unmanaged device.
- Pair M1049 with attack surface reduction rules where available. On Windows, rules such as "Block execution of potentially obfuscated scripts" (5beb7efe-fd9a-4556-801d-275e5ffc04cc), "Block JavaScript or VBScript from launching downloaded executable content" (d3e037e1-3eb8-44c8-a917-57927947596d) and "Block executable content from email client and webmail" (be9ba2d9-53ea-4cdc-84e5-9b1eeee46550) act on the same techniques with a block decision rather than a detection.
- Lock the configuration. With tamper protection on, Microsoft Defender Antivirus keeps real-time, behaviour and cloud protection enabled, keeps security intelligence updates flowing, and prevents exclusions being added or changed locally. Microsoft documents equivalent agent protections for macOS (Disabled, Audit or Block, with Audit the default after installation) and an audit-only preview on Linux. Whatever the product, settings should be owned by central policy, not by local administrators.
- Roll out in rings and keep a rollback. Pilot new engine versions and stricter heuristics on IT and security devices first, then a representative business ring, then everyone. Keep the previous engine and signature version available for rollback, and record which ring every device sits in.
For Microsoft-specific settings see the Microsoft Defender Antivirus guide, and for agent hardening across products the EDR Guide.
Exclusions: where M1049 is most often undone
T1564.012 File/Path Exclusions is in the M1049 mapping because adversaries look for paths the scanner ignores and stage tools there. Microsoft's list of common exclusion mistakes is a good baseline for any product:
| Exclusion type | Never exclude (examples) | Why |
|---|---|---|
| Folders | System drive root, C:\Users\, C:\Windows\Temp\, user AppData\Local\Temp, whole program folders; on Linux and macOS /, /bin, /sbin, /usr/lib | Writable by users or installers, so anything can be dropped there. |
| Extensions | .exe, .dll, .sys, .ps1, .vbs, .js, .jar, .py, .zip, .7z, .tmp | Executables, scripts and archives are the main malware carriers. |
| Processes | powershell.exe, cmd.exe, wscript.exe, mshta.exe, msbuild.exe, outlook.exe; bash, python3, java | Commonly abused interpreters; Microsoft notes a process exclusion also stops network protection and ASR rules inspecting that process. |
| Bare file names and variables | Filename.exe with no path; %TEMP% | Matches anywhere; the antivirus service resolves variables as LocalSystem, so %TEMP% means C:\Windows\TEMP. |
NHI Mgmt Group recommends keeping a separate, owned and dated exclusion list per workload, reviewed quarterly, and alert on any exclusion added outside change control. The EDR Tuning and Exclusions Management Guide covers the governance process.
Where identity fits
Two NHI angles are real here. First, build agents, CI runners and deployment servers are often excluded wholesale "for performance", yet they hold pipeline tokens, cloud keys and signing material; an excluded build directory is an ideal place to stage a credential stealer. Scope those exclusions to specific output paths and keep script inspection on. Second, the accounts that manage the antivirus console and push its policy are privileged non-human and human identities: if they can create exclusions or disable protection across the fleet, protect them like domain administrators. See the Service Account Security Guide.
What M1049 does not stop
These are technique classes outside the M1049 mapping, with the mitigation that ATT&CK positions for them. This is about coverage, not bypass methods.
| Gap | Example techniques | What covers it |
|---|---|---|
| Legitimate credentials | T1078 Valid Accounts | M1032 Multi-factor Authentication, M1026 Privileged Account Management, identity threat detection |
| Credential theft from memory | T1003.001 LSASS Memory | Credential protection (M1043), the ASR rule blocking credential stealing from LSASS where LSA protection is not enabled |
| Abuse of signed system binaries | T1218 System Binary Proxy Execution | M1038 Execution Prevention, M1050 Exploit Protection |
| Exploitation of software flaws | T1190, T1203, T1068 | M1051 Update Software, M1050 Exploit Protection |
| Turning the agent off | T1685 Disable or Modify Tools | Tamper protection, privileged account control, alerting on agent health; see the Bring Your Own Vulnerable Driver and EDR Killers Guide |
| Encryption at scale | T1486 Data Encrypted for Impact | M1040 Behavior Prevention on Endpoint, M1053 Data Backup |
The ToolShell SharePoint campaign shows both sides. Microsoft's guidance was to enable AMSI integration with Defender Antivirus on SharePoint servers, which helps against the web shell stage, but the stolen ASP.NET machine keys kept attackers inside after patching until the keys were rotated. Antivirus could not fix a stolen secret. See the ToolShell SharePoint exploitation breach analysis.
Detection and measurement
Forward antivirus events to the SIEM and treat configuration drift as a detection, not an IT ticket. Monitor detections and quarantine outcomes, remediation failures, real-time protection or tamper protection turned off, new exclusions, AMSI provider failures, and signature update failures. KPIs that show M1049 is working:
- Coverage: percentage of assets in the CMDB with a healthy, reporting agent, per platform (NHI Mgmt Group target: 99 percent or better on servers).
- Signature age: percentage of devices with intelligence older than 24 hours, or the product's own freshness threshold.
- Protection state: devices with real-time, cloud and behaviour protection all on, and tamper protection enforced.
- Exclusion hygiene: total exclusions, exclusions without an owner or review date, and exclusions matching the "never exclude" table.
- Remediation success: share of detections that end in quarantine or removal without manual work.
- Technique test pass rate: results of a quarterly benign test set covering each row of the mapping table (EICAR file, obfuscated test script, archive within archive, macro document), run in a lab ring.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SI-3 Malicious Code Protection; SI-4 System Monitoring | The primary control for M1049, plus monitoring of its alerts. |
| NIST CSF 2.0 | DE.CM-09; PR.PS-05 | Monitoring software and runtime for adverse events; preventing unauthorised software execution. |
| CIS Controls v8.1 | Control 10 Malware Defenses | Deploy and maintain anti-malware, automatic signature updates, central management. |
| ISO/IEC 27001:2022 | Annex A 8.7 Protection against malware | Malware protection supported by user awareness. |
| MITRE D3FEND | D3-FH, D3-FCR, D3-PA | The defensive techniques D3FEND relates to M1049. |
Common failure patterns
- Signature-only on servers: cloud and behaviour protection left off on servers "for stability", leaving polymorphic and packed samples to static matching alone.
- Agent installed, AMSI absent: a third-party product registered as the antivirus without a working AMSI provider, so script content is never inspected.
- Exclusions that grew for years: temp folders, whole program directories and interpreter processes excluded to solve a performance ticket, then forgotten.
- Linux and build hosts left out: coverage reported on Windows laptops only, while CI runners and Linux servers holding secrets run nothing.
- Local admins can switch it off: no tamper protection, so the first action after privilege escalation is to disable the engine.
- Treating a clean scan as a clean host: after a web shell or credential theft incident, the scan comes back clean while stolen keys remain valid, as in the ToolShell case above.
Practitioner checklist
- Confirm a managed antimalware agent on every Windows, macOS and Linux asset, including servers, build agents and VDI.
- Enable real-time, cloud-delivered and behavioural protection by central policy.
- Verify AMSI provider registration and test that obfuscated test scripts are inspected.
- Enable archive and email attachment scanning at the gateway and endpoint.
- Enforce tamper protection and alert on any protection-state change.
- Rebuild the exclusion list per workload, with owner and review date, and remove anything in the "never exclude" table.
- Deploy complementary ASR or equivalent rules in audit, then block.
- Run a quarterly benign technique test set and track the pass rate.
- Map the gaps in this guide to M1038, M1040, M1050 and M1051 owners.
Standards and references
- MITRE ATT&CK: M1049 Antivirus/Antimalware
- MITRE D3FEND: Knowledge graph of cybersecurity countermeasures
- NIST: SP 800-53 Rev 5 Security and Privacy Controls
- Microsoft Learn: Antimalware Scan Interface (AMSI)
- Microsoft Learn: Common mistakes to avoid when defining exclusions
- Microsoft Learn: Protect security settings with tamper protection
- Microsoft Learn: Attack surface reduction rules reference
- Apple: Protecting against malware in macOS
Related NHI Mgmt Group resources: Next-Generation Antivirus (NGAV) Guide · EDR Guide · EDR Tuning and Exclusions Management Guide · EDR Evasion and Defence Guide · M1040 Behavior Prevention on Endpoint