An attacker bypasses endpoint antivirus using a signed Microsoft Office macro to download a PowerShell payload that runs entirely in memory. Which endpoint defense capability MOST effectively detects this attack?

C is correct because blocking Office from spawning child processes like PowerShell via Attack Surface Reduction rules prevents the initial stage. EDR behavioral monitoring detects anomalous in-memory execution patterns even for completely fileless attacks. A is wrong because the payload runs entirely in memory and has no file to scan; signatures are ineffective. B is wrong because disk encryption protects data at rest and has no relevance to in-memory execution. D is wrong because content filtering may block some delivery vectors but does not prevent malicious macros within documents users legitimately receive and open.