[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:cis\u002F10":3},{"item":4,"lessons":16,"controls":67,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"cis","10","Control 10","Malware Defenses",305,"Center for Internet Security (CIS)","**What it asks for.** Organisations should prevent or control the installation, spread and execution of malicious code on their assets. This includes centrally managed anti-malware, automatic updates and protections against common delivery methods such as removable media and autorun.\n\n**In practice.** Endpoint protection or EDR is deployed on all supported endpoints and servers, managed centrally and updated automatically, with behaviour based detection enabled. Autorun is disabled, removable media is scanned or restricted, and exploit protection features of the operating system are turned on. Auditors expect deployment coverage reports, evidence that agents are healthy and current, and records of how alerts are triaged.\n\n**Common gaps.** Coverage gaps on servers, Linux systems and unmanaged devices are common, as are agents that are installed but outdated or in a passive mode. Alerts are sometimes generated with nobody responsible for acting on them.",null,"https:\u002F\u002Fwww.cisecurity.org\u002Fcontrols\u002Fmalware-defenses","Read the control at CIS","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},320,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"gootloader-malware-enabled-44-ransomware-attacks-via-seo-poisoning-and-weak-endpoint-defenses","Gootloader Malware Enabled 44 Ransomware Attacks via SEO Poisoning and Weak Endpoint Defenses","2026-11-13T17:21:02.612+00:00",{"slug":24,"title":25,"published_at":26},"gootloader-takedown-exposes-risks-of-compromised-websites-and-access-as-a-service-malware","Gootloader Takedown Exposes Risks of Compromised Websites and Access-as-a-Service Malware","2026-11-13T16:22:57.628+00:00",{"slug":28,"title":29,"published_at":30},"windows-clfs-zero-day-enables-system-privilege-escalation-before-patch-exists","Windows CLFS Zero-Day Enables SYSTEM Privilege Escalation Before Patch Exists","2026-11-12T19:21:35.885+00:00",{"slug":32,"title":33,"published_at":34},"cruciferra-maas-crypter-hides-infostealers-and-rats-from-security-tools-at-scale","Cruciferra MaaS Crypter Hides Infostealers and RATs from Security Tools at Scale","2026-11-12T13:20:21.227+00:00",{"slug":36,"title":37,"published_at":38},"gsocket-abused-for-persistent-linux-server-access-via-cron-systemd-and-kernel-exploits","GSocket Abused for Persistent Linux Server Access via Cron, systemd, and Kernel Exploits","2026-11-12T10:20:57.284+00:00",{"slug":40,"title":41,"published_at":42},"ebpf-rootkits-a-stealthy-new-threat-evading-traditional-linux-defenses","eBPF Rootkits: A Stealthy New Threat Evading Traditional Linux Defenses","2026-11-11T16:21:00.402+00:00",{"slug":44,"title":45,"published_at":46},"turla-hijacked-exchange-servers-as-covert-c2-infrastructure","Turla Hijacked Exchange Servers as Covert C2 Infrastructure","2026-11-10T22:21:40.469+00:00",{"slug":48,"title":49,"published_at":50},"turlas-cereal-malware-silently-harvests-emails-from-exchange-servers","Turla's Cereal Malware Silently Harvests Emails from Exchange Servers","2026-11-10T14:21:42.016+00:00",{"slug":52,"title":53,"published_at":54},"turlas-cereal-malware-hijacks-exchange-mail-flow-for-espionage","Turla's Cereal Malware Hijacks Exchange Mail Flow for Espionage","2026-11-10T11:23:25.058+00:00",{"slug":56,"title":57,"published_at":58},"marsalek-infostealer-hides-in-fake-game-cheats-to-steal-credentials-and-crypto","Marsalek Infostealer Hides in Fake Game Cheats to Steal Credentials and Crypto","2026-11-05T11:20:28.389+00:00",{"slug":60,"title":61,"published_at":62},"anthropic-adds-edr-visibility-into-ai-agent-activity-inside-claude-cowork-vms","Anthropic Adds EDR Visibility Into AI Agent Activity Inside Claude Cowork VMs","2026-11-03T05:20:22.821+00:00",{"slug":64,"title":65,"published_at":66},"immutable-linux-systems-show-how-eliminating-attack-surface-hardens-security-posture","Immutable Linux Systems Show How Eliminating Attack Surface Hardens Security Posture","2026-10-27T06:20:46.578+00:00",[68,73,78,83,88,93],{"slug":69,"name":70,"problem":71,"stories":72},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",261,{"slug":74,"name":75,"problem":76,"stories":77},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",65,{"slug":79,"name":80,"problem":81,"stories":82},"patch-management","Automated patch management","Known holes get closed in days, not months.",64,{"slug":84,"name":85,"problem":86,"stories":87},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",63,{"slug":89,"name":90,"problem":91,"stories":92},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",44,{"slug":94,"name":95,"problem":96,"stories":97},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",39,[99,105,111,116,121,126,131,136],{"family":100,"item":101,"code":102,"title":103,"together":104},"nist-800-53","si-3","SI-3","Malicious Code Protection",188,{"family":106,"item":107,"code":108,"title":109,"together":110},"gdpr","32","Article 32","Security of processing",125,{"family":5,"item":112,"code":113,"title":114,"together":115},"2","Control 2","Inventory and Control of Software Assets",109,{"family":5,"item":117,"code":118,"title":119,"together":120},"13","Control 13","Network Monitoring and Defense",105,{"family":122,"item":123,"code":124,"title":125,"together":120},"nist-csf","de-cm","DE.CM-1","Continuous Monitoring",{"family":127,"item":128,"code":129,"title":129,"together":130},"itil","overview","ITIL",88,{"family":5,"item":132,"code":133,"title":134,"together":135},"7","Control 7","Continuous Vulnerability Management",74,{"family":5,"item":137,"code":138,"title":139,"together":82},"14","Control 14","Security Awareness and Skills Training"]