My antivirus keeps me safe.
Signature detection is a floor, not a ceiling. Modern intrusions are built to walk straight past it.
At a glance
- The myth
- Endpoint antivirus will catch an attacker
- The reality
- Signatures catch known files; real intrusions avoid known files
- What AV is good at
- Commodity malware, known-bad hashes, opportunistic infections at scale
- What it misses
- Novel code, in-memory execution, trusted-tool abuse, identity attacks
- What actually helps
- Behavior-based detection (EDR), telemetry, detection engineering, defense in depth
- Framework
- MITRE ATT&CK, MITRE Engenuity ATT&CK Evaluations
What antivirus actually does
Classic antivirus answers one question very well: have I seen this exact bad thing before? It compares files against a database of signatures, byte patterns, hashes, and rules distilled from malware that vendors have already analyzed. Modern engines add heuristics and machine-learning classifiers that generalize a little beyond exact matches, and cloud lookups that check a file's reputation across a vendor's whole install base.
This is genuinely valuable. The overwhelming majority of malicious files on the internet are commodity: reused, repackaged, and already known. Antivirus clears that noise at a scale no analyst could match, and for opportunistic threats, a drive-by download, a malicious email attachment, a pirated installer, it is often enough. The mistake is treating a control tuned for the known and the commodity as if it also covers the unknown and the deliberate.
Why a signature is a floor
A signature describes something the vendor has already seen. A capable intruder simply does not use anything the vendor has already seen. The tooling is built or modified for the engagement, compiled fresh, and often unique to a single target. There is no prior sample, so there is no signature, so there is nothing to match.
Heuristics and ML models raise the floor, but they raise it against files. Their entire frame of reference is an object sitting on disk that can be scored as more or less suspicious. The most consequential techniques are designed to never present such an object, or to present one that is indistinguishable from software you run on purpose.
The core asymmetry. Detection-by-signature is a denylist: it can only recognize what has already been named. An attacker who controls their own tooling always moves first. That is not a flaw in any particular product, it is the structural limit of recognizing the known.
From files to behavior: the rise of EDR
The industry's answer to this limit is Endpoint Detection and Response. Instead of asking "is this file known-bad," EDR asks "is this behavior suspicious," and it watches continuously: process creation and lineage, command lines, module loads, memory operations, registry and file changes, network connections, and API and kernel activity surfaced through instrumentation such as Event Tracing for Windows (ETW).
Behavior is far harder to fake than a file, because at some point an intrusion has to act: spawn a child process, touch a credential store, reach out to a command channel, move laterally. Those actions leave telemetry even when no malicious file ever lands on disk. This is why the serious question is not "do you run antivirus" but "do you collect and act on endpoint telemetry, and would anyone notice the alert."
Living off the land
The cleanest way to avoid a malicious file is to not bring one. "Living off the land" means using the trusted, signed tools already present on the system, the scripting engines, administrative utilities, and management frameworks that ship with the operating system, to accomplish attacker goals. To a file scanner, these binaries are not just benign, they are Microsoft-signed and expected.
This is why modern detection focuses on how a trusted tool is used rather than whether it is present. A signed scripting host is normal; a signed scripting host launched by a document, reaching out to the internet, and spawning a system utility is a story. Catching that story requires context and behavior, exactly what antivirus does not model.
In memory, not on disk
The other way to avoid a file is to never write one. So-called fileless techniques run code in memory, inside an existing trusted process, so that a disk scan finds nothing to score. The payload lives in RAM, does its work, and can vanish on reboot, leaving little for a traditional scanner that fundamentally reasons about objects on a filesystem.
Memory-resident activity is not invisible, it is just invisible to the wrong tool. It shows up in process memory telemetry, in anomalous module loads, and in the network and identity actions that follow. Detecting it is a job for behavioral instrumentation, not signatures.
The dangerous inference. "The endpoint agent is green, so we are clean" assumes the agent can see everything that matters. Against in-memory and trusted-tool techniques, a quiet antivirus console is not evidence of safety. It may only mean the one control you are watching was never the right place to look.
The attacks that never touch the endpoint
Plenty of modern intrusions barely involve the endpoint at all. A phishing page that captures a live session token lets an attacker log in as the user from their own machine, with a valid session, no malware required. Abusing cloud and identity misconfigurations, stealing API keys, or consenting a malicious OAuth application are all paths to real access that an endpoint antivirus is simply not in the way of.
Once identity is the perimeter, the endpoint agent is watching a door the attacker walked around. That is the whole point of thinking in terms of coverage rather than products: the question is not how good any one control is, but whether the paths that matter are watched at all.
What each layer sees, and misses
Different controls have different blind spots. The value is in the overlap, not any single row.
| Control | Catches well | Blind to |
|---|---|---|
| Signature antivirus | Known-bad files, commodity malware, known hashes | Novel code, in-memory execution, trusted-tool abuse |
| EDR (behavioral) | Suspicious process behavior, lineage, memory and API activity | Activity off the endpoint (identity, cloud), gaps in telemetry or tuning |
| Network / NDR | Command-and-control patterns, unusual egress, lateral movement | Encrypted or cloud-native traffic without deeper inspection |
| Identity / logs | Anomalous logins, token use, consent grants, privilege changes | Actions that look like a legitimate, authenticated user |
| Human threat hunting | The story across all of the above; the thing no single alert fired on | Whatever telemetry was never collected in the first place |
What actually works: defense in depth
No single control catches a determined attacker. Resilience comes from layers that each cover the others' blind spots, and from assuming any one of them will be bypassed:
- Keep the antivirus. It is a genuine, cheap floor against commodity threats. Removing it is not the lesson here.
- Add behavior. EDR or equivalent telemetry is the difference between watching files and watching what attackers actually do.
- Collect and centralize the logs that matter: endpoint, network, and especially identity and cloud. You cannot detect what you never recorded.
- Do detection engineering against a real model of adversary behavior, MITRE ATT&CK is the common language, rather than trusting default rules.
- Assume breach. Segment, enforce least privilege, use phishing-resistant MFA, and hunt on the assumption that prevention already failed somewhere.
How we test your detection
The honest way to find out whether your defenses stop a real attacker is to have one try, under controlled conditions. On a red team engagement we do not measure success by whether antivirus fired. We map, against MITRE ATT&CK, which of our actions produced telemetry, which produced an alert, and which an analyst actually actioned, and we hand that coverage map back to your team. Prevention that never gets exercised is a hope. Detection you have watched fail, and then fixed, is a control.
Key takeaway
Antivirus answers "have I seen this before." Real attackers make sure the answer is always no.
Safety is not a product you own, it is coverage you can prove. Keep the floor, add behavior, collect the telemetry that matters, and test whether anyone would actually notice. A green console is not the same as a watched one.
References & further reading
- MITRE, ATT&CK. The public knowledge base of real-world adversary tactics and techniques; the common language for detection coverage.
- MITRE Engenuity, ATT&CK Evaluations. Independent, transparent tests of endpoint products against emulated adversary behavior.
- MITRE, LOLBAS Project. A catalog of trusted, signed binaries that can be abused, illustrating why signatures alone are insufficient.
- Microsoft, About Event Tracing (ETW). The instrumentation behind much modern behavioral endpoint telemetry.
- NIST, SP 800-207 Zero Trust Architecture. Why identity-centric, assume-breach design outperforms perimeter and endpoint trust.