You Can Run, but You Can’t Hide: Defender Exclusions
Attackers abuse Microsoft Defender Antivirus exclusions via PowerShell, WMI, GPO, or direct registry edits to evade scans, and can hide those exclusions from administrators using a registry value. MDAV exclusions remove paths, extensions, processes, and IPs from real-time and scheduled scans. Attackers set exclusions through four vectors that all converge on two registry keys. A separate registry value, HideExclusionsFromLocalAdmins, prevents both admin and SYSTEM accounts from querying active exclusions via PowerShell or WMI, requiring direct registry inspection to detect.
Detection / Hunteropenrouter
Immediate Actions
- Query the registry directly for both Exclusions keys to find hidden exclusions on all endpoints.
- Audit all endpoints for HideExclusionsFromLocalAdmins set to 1 and reset to 0.
- Remove any exclusion paths targeting root drives, Temp, or Downloads directories.
Key Takeaways
- Four exclusion types exist: Process, Path, Extension, and IpAddress.
- GootKit, WhisperGate, and Muddled Libra all leveraged MDAV path exclusions.
- GPO-based exclusions key can be directly modified without touching the locked-down MDAV key.
- HideExclusionsFromLocalAdmins also blocks SYSTEM-level queries, not just administrators.
- Direct registry inspection remains the only way to query hidden exclusions.
- Huntress EDR collects telemetry on exclusion registry operations and suspicious exclusion paths.
Attack Chain
- Initial Access: Attacker gains admin-level access through prior compromise or initial vector
- Defense Evasion: Attacker sets MDAV path or extension exclusion via PowerShell, WMI, GPO, or direct registry modification
- Concealment: Attacker sets HideExclusionsFromLocalAdmins registry value to hide exclusions from queries
- Execution: Malicious binaries dropped into excluded paths run without real-time or scheduled scan coverage
- Persistence: Excluded paths remain active across reboots; GPO-based exclusions persist until policy removal
Affected Systems
- Windows endpoints with Microsoft Defender Antivirus
- Windows Server with MDAV enabled
- Environments using GPO-managed Defender policies
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | Registry modifications are visible, but HideExclusionsFromLocalAdmins blinds standard PowerShell/WMI exclusion queries. |
| Network Visibility | None | Technique is entirely host-based; no network indicators involved. |
| Detection Difficulty | Moderate | Registry monitoring catches all vectors, but distinguishing legitimate admin exclusions from malicious ones requires path-based heuristics. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Registry writes to HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths indicate defense evasion via direct GPO key modification (T1562.001, T1112). | Sysmon Event ID 13, Windows Event 4657 | Defense Evasion | Medium — legitimate GPO-configured exclusions also write this key |
| Setting HideExclusionsFromLocalAdmins to 1 indicates an attacker concealing exclusion activity from defenders (T1562.006). | Sysmon Event ID 13, Windows Event 4657 | Defense Evasion | Low — this value has no legitimate administrative use case |
| Set-MpPreference or Add-MpPreference with ExclusionPath arguments targeting root drives or temp directories indicates malicious exclusion creation (T1562.001). | PowerShell Script Block Logging Event 4104 | Defense Evasion | Medium — some software installers legitimately add temporary exclusions |
Required Log Sources
- Sysmon Event ID 13 (Registry Value Set)
- Sysmon Event ID 12 (Registry Create/Delete)
- Windows Security Event ID 4657
- PowerShell Script Block Logging (4104)
- MDAV operational event log
Key Behavioral Indicators
- Registry writes to Exclusions\Paths under the Policies key by non-GPO processes
- HideExclusionsFromLocalAdmins set to REG_DWORD 1
- Exclusion paths targeting C:, C:\Temp, or Downloads directories
- Invoke-CimMethod targeting MSFT_MpPreference class with Add method
- reg.exe adding values under Windows Defender\Exclusions\Paths
Control Gaps
- Standard Get-MpPreference queries return nothing when HideExclusionsFromLocalAdmins is set
- EDR products relying on WMI or PowerShell to enumerate exclusions are blinded by HideExclusionsFromLocalAdmins
- GPO-based registry modifications bypass MDAV process-level protections on the primary exclusions key
False Positive Assessment
Medium — legitimate administrators and software installers routinely set MDAV exclusions; distinguishing malicious from benign requires path-based and context-based heuristics.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Restrict GPO edit permissions to a dedicated security group with change review.
- Deploy Sysmon registry monitoring for both Defender Exclusions registry keys.
- Enable PowerShell Script Block Logging on all endpoints to capture exclusion cmdlet usage.
User Protection
- Ensure EDR agents query exclusions via direct registry reads, not PowerShell or WMI.
- Alert on any new MDAV exclusion created outside of an approved GPO workflow.
Security Awareness
- Train SOC analysts that Get-MpPreference can return empty results when exclusions are hidden.
- Document the direct registry inspection procedure for Defender exclusions in incident response playbooks.
MITRE ATT&CK Mapping
Execution
Defense Impairment
Plain-Language Summary
Attackers are telling Windows Defender to skip scanning specific folders or file types, which lets malicious files run undetected. They can do this through several methods including PowerShell commands and direct registry changes. A newly highlighted technique also lets attackers hide these exclusions so that even system administrators cannot see them through normal tools. Organizations should monitor the Windows registry for unexpected Defender exclusion changes and check the registry directly if exclusions appear hidden.
Additional IOCs
- Registry Keys:
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths- GPO registry subkey for path exclusions, directly writableHKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths- MDAV-managed path exclusions subkey, locked down by MDAV
- Command Lines:
- Purpose: Add Defender path exclusion via PowerShell cmdlet | Tools:
powershell.exe,Set-MpPreference| Stage: Defense Evasion |Set-MpPreference -ExclusionPath - Purpose: Add Defender path exclusion via PowerShell cmdlet (append mode) | Tools:
powershell.exe,Add-MpPreference| Stage: Defense Evasion |Add-MpPreference -ExclusionPath - Purpose: Add Defender exclusion via WMI CIM method invocation | Tools:
powershell.exe,Invoke-CimMethod,MSFT_MpPreference| Stage: Defense Evasion - Purpose: Directly add path exclusion to GPO registry key | Tools:
reg.exe| Stage: Defense Evasion - Purpose: Hide Defender exclusions from admin and SYSTEM queries | Tools:
reg.exe| Stage: Defense Evasion
- Purpose: Add Defender path exclusion via PowerShell cmdlet | Tools:
- registry_keyHKLM\SOFTWARE\Microsoft\WindowsDefender\ExclusionsMDAV exclusions key written by MsMpEng.exe for all exclusion types
- registry_keyHKLM\SOFTWARE\Microsoft\WindowsDefender\Exclusions\PathsMDAV-managed path exclusions subkey, locked down by MDAV
- registry_keyHKLM\SOFTWARE\Policies\Microsoft\WindowsDefender\ExclusionsGPO exclusions key, directly modifiable by attackers without MDAV lockout
- registry_keyHKLM\SOFTWARE\Policies\Microsoft\WindowsDefender\Exclusions\PathsGPO registry subkey for path exclusions, directly writable
- registry_keyHKLM\SOFTWARE\Policies\Microsoft\WindowsDefender\HideExclusionsFromLocalAdminsHides exclusions from admin and SYSTEM queries via PowerShell/WMI