Hackers Hide Microsoft Defender Exclusions From Admins to Evade Antivirus Scans
Huntress warns attackers hide Microsoft Defender exclusions so malware stays unscanned and invisible to admins.
Huntress reported that attackers with local administrator rights combine broad Microsoft Defender Antivirus exclusions with the HideExclusionsFromLocalAdmins policy so files stay unscanned and the exclusions are hidden from ordinary admin queries. The policy is stored at HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\HideExclusionsFromLocalAdmins and does not remove existing exclusions. GootKit previously added path exclusions through WMI, and WhisperGate used PowerShell to exclude the C: drive. Huntress maps the behavior to MITRE ATT&CK T1562.001 and recommends registry monitoring rather than relying on Get-MpPreference.
- HideExclusionsFromLocalAdmins hides exclusions from Get-MpPreference and admins.
- Broad path or extension exclusions can leave staged malware unscanned.
- GootKit used WMI exclusions; WhisperGate excluded the C: drive.
- Defenders should alert on Defender exclusion and hide-policy registry keys.
- Vendors
- Microsoft
- Products
- Microsoft Defender Antivirus
- Malware
- GootKitWhisperGate
From the original article
3 min read at gbhackers.com
Threat actors are increasingly abusing Microsoft Defender Antivirus exclusions to keep malicious files outside the reach of endpoint scans, and a little-known policy setting can conceal those exclusions from administrators using normal management tools.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.