CIS (CFP) Not Recognizing File Changes

I’ll try to be brief. I beta test Firefox and Thunderbird. Every night there is an update to these betas. When I was running Norton Internet Security, I was alerted when Firefox (or Thunderbird) wanted to connect to the Internet after I updated them (because there was a difference in the new firefox.exe or thunderbird.exe file that Norton recognized).

I don’t get these alerts from CIS. CIS doesn’t see the change in the firefox.exe or thunderbird.exe files.

What if some virus or malware were to replace either of these files, would CIS allow them to connect? What if this were to happen with another type of file that is already allowed to connect?

if malware tries to modify an application (ex. ff, thunderbird), you should be alerted

Thanks, I was just curious!