Microsoft Defender Antivirus permits administrators to exclude specific files, folders, processes, or IP addresses from scanning This article explores windows defender exclusions. . Path and extension exclusions are particularly valuable to attackers, as they can disable scanning on entire directories or file types, allowing malicious binaries to run undetected.

By setting the registry value HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\HideExclusionsFromLocalAdmins to 1, exclusions remain active but are not visible in PowerShell output and the Windows Security interface. Attackers commonly create exclusions using PowerShell (Set-MpPreference or Add-MpPreference), WMI, Group Policy, or direct registry edits under HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions. View of GPO exclusion of C:\temp (Source: Huntress) For instance, WhisperGate added an exclusion for the entire C:\ drive, while GootKit excluded specific folders via WMI.

Key mitigation steps include: Regularly audit exclusions: Use both PowerShell (Get-MpPreference) and direct registry checks under HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions and HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions. Investigate suspicious paths: Pay close attention to exclusions on broad locations such as C:\, C:\Temp, C:\Users, or Downloads, which are frequently used by malware. Implement centralized management: Use Intune or Group Policy for exclusions instead of ad hoc local changes, and keep an approved list of necessary exclusions.

Security vendors, such as Huntress, now track telemetry on exclusion-related registry activity and flag suspicious exclusions and the use of the hide setting.