In SCCM 2012 with Service Pack 1 (SP1) with Endpoint Protection (SCEP) it was needed to look in registry when multiple anti-malware policies were active. More about that here: Prepare ConfigMgr client for Sysprep or Master Image.
It mentions: The policy name in SCEP will be named "Antimalware policy" by default. All SCEP policies applied can be found in registry: "HKLM\Software\Microsoft\CCM\EPAgent\LastAppliedPolicy"
In SCCM 2012 Release 2 (R2) this isn't needed anymore. This because multiple anti-malware policies are displayed in the SCEP client now. Much better this way isn't it!?