Skip to content

Antivirus/Antimalware

Mitigation · ATTACK:enterprise:M1049

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:M1049",
  "title": "Antivirus/Antimalware",
  "type": "Mitigation",
  "source_url": "https://attack.mitre.org/mitigations/M1049",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "course-of-action--a6a47a06-08fc-4ec4-bdc3-20373375ebb9",
  "external_id": "M1049",
  "domain": "enterprise",
  "created": "2019-06-11T17:08:33.055Z",
  "modified": "2024-12-10T15:58:23.136Z",
  "version": "1.2",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [

  ]
}

Explicit source assertions (23)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:M1049 → mitigates → ATTACK:enterprise:T1027.015

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0b1d3aa7-eae6-4ab3-89ca-e4771696975e

ATTACK:enterprise:M1049 → mitigates → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1461fa53-bc4f-4ae5-b131-3f6058e6a72a

ATTACK:enterprise:M1049 → mitigates → ATTACK:enterprise:T1036.008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1596b872-504f-41f2-b9e4-918c795f0050

ATTACK:enterprise:M1049 → mitigates → ATTACK:enterprise:T1221

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2357634d-3e93-41f3-90d5-91fe4d0deb7e

Anomali Template Injection MAR 2018

ATTACK:enterprise:M1049 → mitigates → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--26d24472-ae04-46e7-9166-5d8a8f6f16f7

ATTACK:enterprise:M1049 → mitigates → ATTACK:enterprise:T1027.014

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--27993745-de4c-4ce0-b27d-cd591b0489c2

ATTACK:enterprise:M1049 → mitigates → ATTACK:enterprise:T1027.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2ee0c642-94af-491c-bc65-821e13586bca

ATTACK:enterprise:M1049 → mitigates → ATTACK:enterprise:T1564.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3d24da0a-7124-4043-881b-da19436c007c

Microsoft File Folder Exclusions

ATTACK:enterprise:M1049 → mitigates → ATTACK:enterprise:T1027.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--668b73fd-0b71-49a5-a756-5213c0bcf6d5

ATTACK:enterprise:M1049 → mitigates → ATTACK:enterprise:T1566.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6c1c0c1e-91fb-4285-9656-8d452e630fb3

ATTACK:enterprise:M1049 → mitigates → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--70b511c9-5a2c-4810-87b6-73dfc648ec29

ATTACK:enterprise:M1049 → mitigates → ATTACK:enterprise:T1059.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--758cbc32-6b33-4012-8622-cd7d218a799c

ATTACK:enterprise:M1049 → mitigates → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--85f30e9c-08f6-48d6-a25d-47ef1c51ebab

ATTACK:enterprise:M1049 → mitigates → ATTACK:enterprise:T1059

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8d56622d-547a-4daa-89b8-1c555d1ac5b7

ATTACK:enterprise:M1049 → mitigates → ATTACK:enterprise:T1547.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9fa87ff9-ee4a-4660-8cd8-b2b3da820b1f

SourceForge rkhunter · Chkrootkit Main

ATTACK:enterprise:M1049 → mitigates → ATTACK:enterprise:T1080

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a2bda2c9-b4cb-4a4c-9fce-f8efbab38fa6

Mandiant Cloudy Logs 2023

ATTACK:enterprise:M1049 → mitigates → ATTACK:enterprise:T1564

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a4139ea2-b04d-472a-9daa-0ff3eb5586ce

Microsoft File Folder Exclusions

ATTACK:enterprise:M1049 → mitigates → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a44728b1-9cb4-4307-8c4c-37b5acba536e

ATTACK:enterprise:M1049 → mitigates → ATTACK:enterprise:T1027.016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a5b3e4ab-3150-4dc0-b78a-e26b4c04d796

ATTACK:enterprise:M1049 → mitigates → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dc595175-bd4d-4409-829b-43c42b762647

ATTACK:enterprise:M1049 → mitigates → ATTACK:enterprise:T1566

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ed821f5e-9527-4fbb-ae76-37a79592dfb6

ATTACK:enterprise:M1049 → mitigates → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f12b1234-4eb8-4b3d-8b84-50df8dfa8df9

ATTACK:enterprise:M1049 → mitigates → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ffa8f46b-615f-4b95-8ed5-90f86eaedd20

Microsoft AMSI June 2015

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.