Shortly after arriving at work, a payroll clerk opens an invoice attachment and clicks to enable its macro. No file on the disk matches a known malware signature, and the antivirus stays quiet. What gives the attack away is behavior: Word starting PowerShell, PowerShell contacting an address nobody has seen before, and a new scheduled task appearing a minute later.
Endpoint security is the set of tools that watch and defend each device from the inside. On the CompTIA Security+ SY0-801 exam it sits under objective 4.1, which expects you to choose the right mitigating control for a scenario; the endpoint tools named there are antivirus, endpoint detection and response (EDR), extended detection and response (XDR) and host-based intrusion detection and prevention (HIDS/HIPS). This lesson explains what each one sees, what it can do, what its alerts look like, and where the host-based firewall fits beside them.
Signature-based antivirus catches what it has seen before
Traditional antivirus compares files against a database of signatures: hashes of known malicious files and byte patterns that identify a malware family. The on-access scanner checks a file when it is written, opened or executed, scheduled scans sweep the disk, and a match triggers an action, usually quarantine.
Signatures are fast and produce few false positives, which is why every endpoint still runs them. Their weakness is that they recognize only what someone has already seen and described. Polymorphic malware changes its code with each copy, a recompiled variant has a new hash, and fileless attacks that run scripts in memory leave no file to scan. Heuristic rules that flag suspicious structure, such as packed code or unusual imports, catch some variants, but the core model is still lookup.
That makes signature currency part of the control. On Windows, an administrator checks Microsoft Defender Antivirus like this:
PS C:\> Get-MpComputerStatus | Format-List AntivirusEnabled, RealTimeProtectionEnabled, AntivirusSignatureLastUpdated, IsTamperProtected
AntivirusEnabled : True
RealTimeProtectionEnabled : True
AntivirusSignatureLastUpdated : 10/21/2026 6:02:11 AM
IsTamperProtected : True
Detections are logged in Microsoft-Windows-Windows Defender/Operational: event 1116 when malware is detected and 1117 when an action such as quarantine is taken. Event 5001, real-time protection disabled, deserves its own alert, because switching off antivirus is a routine early step for attackers. Tamper protection exists to stop exactly that.
On the exam, a known malware sample, a known file hash or out-of-date definitions point to signature-based antivirus. A never-before-seen attack points somewhere else.
Behavior-based detection judges code by what it does
Behavior-based detection ignores what a file looks like and watches what running code does. Some actions are suspicious whichever program performs them:
- An Office application starting a command shell or PowerShell.
- A process reading the memory of lsass.exe, where Windows keeps credential material.
- One process renaming thousands of files and filling each with random-looking data, the classic ransomware pattern.
- A script deleting volume shadow copies with
vssadmin delete shadows.
Products that combine behavior monitoring with machine-learning models of malicious files are often called next-generation antivirus (NGAV). Behavior detection catches new and fileless attacks that signatures miss, at the price of more false positives: a backup agent that touches every file or an admin script that launches PowerShell can look like an attack. Tuning exclusions for those is ongoing work, and every exclusion is a place an attacker could hide.
Most modern endpoint products use signatures and behavior together. What separates antivirus from EDR is what happens after the detection.