17.2 Antivirus, Endpoint Security, and Warning Signs
Three Detection Layers in One Agent
A modern endpoint agent is a stack, not a scanner. The bottom layer is signature matching: known-bad byte patterns or file hashes compared against a definition feed, which is cheap, fast, and only ever catches what somebody already saw. The middle layer is heuristics -- unpacking a binary in an emulator, inspecting imports and packer stubs, checking a document macro that spawns a shell -- which catches variants of known families. The top layer is behavioral: the agent subscribes to kernel-level process, thread, file, and registry callbacks (on Windows via ETW and minifilter drivers, on Linux via fanotify or eBPF probes) and evaluates sequences such as a word processor launching powershell.exe -enc, a process reading another process's memory, or rapid mass file rename with entropy change. Signature layers detect files; behavioral layers detect intent.
Reading the Agent's Own Warnings
The agent is also a log source, and its events have very different meanings. A block with a detection name and a quarantined path is a closed loop: the sample is contained, so the job becomes scope -- how did it arrive, did it execute, is the same hash elsewhere. A "signature mismatch" or stale-definition notice means the bottom layer is blind and everything you trust from it is suspect. A behavioral detection with an action of "audit only" is the loudest signal of all: the sequence happened and nothing stopped it, so it needs a human. Detection names are useful hints, not verdicts -- names are vendor taxonomy, and the same binary can be flagged as ransomware by one engine and as a hacktool by another.
The Override Problem
The most dangerous line in an endpoint report is one an analyst did not write: user dismissed prompt or action skipped. If the local account can click through a block, add exclusions, or stop the service, the agent is advisory rather than enforced. Warning signs cluster here: repeated user overrides on the same host, exclusions pointing at download or temp folders, the agent offline for days while the host keeps producing other logs, and tamper-protection events. Each of those is an attacker shaping the environment before the real payload lands.
Treat the Agent as a Sensor Too
Even when nothing is blocked, agent telemetry -- process trees, command lines, network sockets per process, hashes of executed files -- is the highest-fidelity feed a small team can get. Endpoint detection and response tooling keeps that telemetry queryable, so an alert on one laptop can be answered with "which other hosts ran this same parent-child pair in the last 30 days?" in seconds instead of an afternoon.
Architecture Diagram
Key Takeaways
- Signatures catch known files, heuristics catch variants, behavioral detection catches intent from process and kernel events.
- A quarantine event still needs scope work: delivery path, whether it executed, and the same hash on other hosts.
- Stale definitions or an offline agent mean the file layer is blind -- stop trusting its clean verdicts.
- Remove the local user's ability to dismiss blocks, add exclusions, or stop the service, or your agent is advisory only.
- Keep agent telemetry queryable so one alert can be scoped fleet-wide in seconds.