Defender Exclusion Abuse: How Attackers Hide Malware from MDAV
Huntress details how attackers abuse Microsoft Defender exclusions to hide malware from scans.
Huntress explains how attackers with administrator rights abuse Microsoft Defender Antivirus exclusions to keep malware out of scans. Path, process, extension, and IP exclusions can be created through PowerShell, WMI, Group Policy, or policy registry keys. Setting HideExclusionsFromLocalAdmins can stop local administrators and SYSTEM from listing exclusions with Get-MpPreference, although the values remain readable in the registry. Huntress cites GootKit in 2019, WhisperGate in 2022, and Muddled Libra in 2024 as campaigns that created path exclusions.
- Defender supports path, process, extension, and IP address exclusions.
- Exclusions can be set through PowerShell, WMI, Group Policy, or registry.
- Path and extension exclusions skip real-time, scheduled, and on-demand scans.
- HideExclusionsFromLocalAdmins hides exclusions from local admin and SYSTEM queries.
- GootKit, WhisperGate, and Muddled Libra created Defender path exclusions.
- Vendors
- Microsoft
- Products
- Microsoft Defender Antivirus
- Threat actors
- Muddled Libra
- Malware
- GootKitWhisperGate
- Organizations
- Huntress
From the original article
5 min read at huntress.comSee how attackers like GootKit and WhisperGate abuse Windows Defender exclusions to hide malware from AV scans — and how Huntress detects it.
huntress.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.