Researchers from Huntress have detailed a technique in which attackers do not disable Microsoft Defender. Instead, they create exclusions that open scanning holes around the folders where malware is stored, while the protection status remains apparently active.
Exclusions are a legitimate feature of the product. They can be defined by path, exempting entire directories from scanning, or by extension, exempting files based on suffix. The change can be introduced through several vectors: PowerShell commands, Windows Management Instrumentation, Group Policy, or direct registry writes.
The technique requires administrator privileges, placing it after the initial compromise. It is not used for initial access but for remaining undetected. An additional registry key, HideExclusionsFromLocalAdmins, hides the list of exclusions from local administrators, so queries through the interface show no exempted items.
The behavior is not new. The report connects the practice to GootKit in 2019, to WhisperGate in 2022 that excluded the entire C: drive from scanning, and to Muddled Libra in 2024.
For detection, the recommendation is to monitor the registry, since every modification path ultimately writes there, and to treat exclusions of entire drives or common directories used in attack preparation, such as temporary folders and the downloads directory, as suspicious. Direct registry examination also bypasses the hiding mechanism, because the key remains present even when the interface returns a clean list.
