Hackers Hide Microsoft Defender Exclusions From Admins to Evade Antivirus Scans
Huntress warns attackers hide Microsoft Defender exclusions so malware stays unscanned and invisible to admins.
62
Malware
Gootkit
- Mentions · 7d0
- Mentions · 30d1
- All mentions4
- First seenAug 17, 2026
- Last mentioned29d ago
Timeline
4 articles · newest firstDefender Exclusion Abuse: How Attackers Hide Malware from MDAV
Huntress details how attackers abuse Microsoft Defender exclusions to hide malware from scans.
48
Campaign Evolution: EITest from October through December 2016
Unit 42 details the EITest campaign's late-2016 changes: gates and obfuscation dropped, with Rig EK variants delivering ransomware and infostealers.
24
EITest Campaign Evolution: From Angler EK to Neutrino and Rig
Unit 42 details the EITest campaign's shift from Angler to Neutrino and Rig exploit kits while distributing ransomware, downloaders, and banking trojans.
36
Appears with
- Cerbermalware · 2
- Microsoftvendor · 2
- Palo Alto Networksvendor · 2
- Rig EKmalware · 2
- WhisperGatemalware · 2
- EITestthreat actor · 2
- Ursnifmalware · 2
- Huntressorganization · 2
- Microsoft Defender Antivirusproduct · 2
- Palo Alto Networksorganization · 1
- Bartmalware · 1
- Angler EKmalware · 1
- Chthonicmalware · 1
- Latentbotmalware · 1
- Microsoftorganization · 1
- Muddled Librathreat actor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.