Considering the majority of malware we have to deal with nowadays, your best defenses are:
A firewall that blocks everything by default. I use SimpleFirewall and give trust on a per executable basis.
uBlockOrigin, because dear lord navigating some sites is almost impossible without blocking all that shit
Avoid anything that asks for admin access
Keep an eye on resource usage and be on the lookout for any weird looking processes.
There was one time I downloaded a piece of shit that started to encrypt my drive. Since the CPU fan started spinning loud, I immediately checked task manager, figured what was going on and ended the malicious root process. Next, it was time to scour my folders, especially inside %appdata%, for any possible leftover executables. All clean, restart PC, everything was fine. I lost a couple of files, but nothing personal, just other downloads.