Hackers Abuse Microsoft Defender Exclusions to Evade Antivirus Scans
Attackers are exploiting legitimate Microsoft Defender Antivirus exclusion settings to hide malware, bypassing security scans without disabling the software.
Threat actors are increasingly leveraging a sophisticated evasion technique that abuses Microsoft Defender Antivirus exclusion settings to conceal malware from security scans. Rather than disabling antivirus protection entirely, which would trigger alerts, attackers with administrator privileges can configure Defender to ignore specific files, folders, or file extensions. This allows malicious software to remain hidden in plain sight while the antivirus solution continues to operate, presenting a significant challenge for detection and incident response.
This method is not new and has been observed in connection with various malware families over the years, including GootKit in 2019, WhisperGate in 2022, and Muddled Libra in 2024. Researchers at Huntress have highlighted this recurring weakness, noting that legitimate security configurations are being repurposed as hiding places for malicious payloads. The technique requires attackers to first gain administrative control over a target system, making it a post-exploitation tactic.
Microsoft Defender supports exclusions for paths, file extensions, processes, and IP addresses. Attackers find path and extension exclusions particularly useful. A path exclusion can shelter an entire directory, while an extension exclusion can exempt all files with a specific suffix, such as '.dll' or '.exe', from being scanned. These exclusions effectively remove matching content from scheduled, on-demand, and real-time scanning processes, allowing malicious binaries to operate undetected.
Attackers can implement these exclusion changes through various legitimate Windows administration mechanisms, including PowerShell commands, Windows Management Instrumentation (WMI), Group Policy, or direct registry modifications. This means that detecting such abuse requires incident responders to meticulously examine system logs for suspicious administrative activity rather than simply assuming all administrative operations are benign. Changes to exclusion settings ultimately manifest in the Windows registry, making registry monitoring a crucial component of threat hunting.
Huntress also identified a specific policy setting that can hide exclusions from local administrators querying them via PowerShell. While this setting is designed to conceal exclusions, it can create a misleading impression that no exclusions are in place, even when they have been actively configured by an attacker. Although the exclusions are hidden from standard queries, they remain accessible by directly reading the underlying registry data, underscoring the importance of comprehensive forensic analysis.
This evasion technique can be used in conjunction with other methods. For instance, some attacks have been observed to first use exclusion abuse to shelter malware, and then later disable Defender entirely if the initial stealthy approach is compromised or insufficient. This adaptability highlights the multi-faceted nature of modern malware campaigns.
Incident responders investigating potential intrusions should prioritize examining the creation and concealment of exclusion settings. Relying solely on whether antivirus software appears to be enabled or functioning normally can be insufficient. Monitoring registry changes and administrative actions provides a more robust approach to detecting this sophisticated evasion tactic. The technique underscores the need for continuous vigilance and a deep understanding of how legitimate system configurations can be subverted by advanced persistent threats.
The report does not provide specific victim counts but emphasizes that this is a persistent and evolving threat. The ability for attackers to leverage built-in security features against defenders necessitates a proactive and adaptive security posture, focusing on behavioral analysis and diligent log monitoring.