Hackers Abuse Microsoft Defender Exclusions to Hide Malware From Antivirus Scans
Huntress details how attackers abuse Microsoft Defender path and extension exclusions to hide malware while leaving antivirus scans appearing active.
A September 30 Huntress report describes attackers adding Microsoft Defender exclusions for paths, extensions, processes, and IP addresses via PowerShell, WMI, Group Policy, or direct registry edits, removing malicious files from scheduled, on-demand, and real-time scans. The technique requires administrator privileges and has recurred in intrusions linked to GootKit (2019), WhisperGate (2022), and Muddled Libra (2024). A related policy setting can conceal exclusions from PowerShell queries even under SYSTEM, so empty query results do not prove settings are untouched; Huntress recommends registry monitoring for suspicious broad exclusions such as entire drives.
- Defender path and extension exclusions remove files from all scan types while antivirus stays enabled
- Changes possible via PowerShell, WMI, Group Policy, or registry; Group Policy route requires reboot
- Technique previously seen in GootKit, WhisperGate, and Muddled Libra intrusions
- A concealment policy hides exclusions even from SYSTEM-level PowerShell queries
- Registry monitoring catches broad drive and staging-directory exclusions regardless of method used
- Organizations
- HuntressMicrosoftMuddled Libra
From the original article
4 min read at cybersecuritynews.com
Hackers are abusing Microsoft Defender Antivirus exclusions to keep malicious files outside routine security scans. Rather than switching protection off completely, attackers can leave antivirus running while creating gaps around malware staging folders and selected file types. This is an established evasion technique, not a new malware family.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.