# Attackers Abuse Microsoft Defender Exclusions with HideExclusionsFromLocalAdmins to Evade Antivirus Scans

> Attackers with local administrator privileges pair Microsoft Defender Antivirus exclusions with the HideExclusionsFromLocalAdmins policy setting, creating hidden blind spots where malware runs unscanned and exclusions no longer appear through standard admin tooling such as Get-MpPreference. Huntress research (published 2026-09-30) documents the technique and detection approaches; no CVE is involved.

- **Published:** 2026-10-01T00:00:00Z
- **Last reviewed:** 2026-10-01T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2824
- **ID:** TL-2026-2824
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 10 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Microsoft Defender Antivirus (MDAV) exclusions let a user with administrator privileges or higher bypass AV scans for folders, binaries, extensions and IP addresses. Exclusion types are Process (files opened by a named process), Path (whole directories removed from real-time and scheduled scans), Extension (file types) and IpAddress (network inspection for designated IPs). Exclusions can be configured through Intune, MDM, Group Policy, PowerShell (Set-MpPreference / Add-MpPreference) and WMI (the MSFT_MpPreference class in the root/Microsoft/Windows/Defender namespace, e.g. via Invoke-CimMethod). They can also be written directly to the registry, for example with reg add under HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths.

The HideExclusionsFromLocalAdmins policy value (HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\HideExclusionsFromLocalAdmins, REG_DWORD = 1) is a legitimate hardening control meant to stop local attackers from discovering which locations are excluded. Per the sources, when enabled it prevents exclusions from appearing through ordinary local administrative queries including Get-MpPreference, and can affect SYSTEM-level PowerShell queries. NVISO's analysis notes it also hides exclusions in Registry Editor and Windows Security, and that it does not prevent an admin from creating new exclusions; it only obscures existing ones. An attacker with local admin rights can therefore add an exclusion for a payload staging path and also set the hide flag, so defenders and responders reviewing a host with ordinary tooling do not see the blind spot. Huntress notes the exclusions can still be read by querying the registry directly (HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions and HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions), which bypasses the restriction that blocks PowerShell queries for both administrators and SYSTEM.

Exclusion tampering has precedent: Huntress cites GootKit (2019), which created a Defender path exclusion via the MSFT_MpPreference WMI class, and WhisperGate (2022), which used PowerShell Set-MpPreference to exclude the C:\ drive; it also references Muddled Libra (2024) as using similar techniques. MITRE ATT&CK catalogs the generic behavior as T1562.001 (Impair Defenses: Disable or Modify Tools) and the abuse of pre-existing or well-known exclusions as T1564.012 (Hide Artifacts: File/Path Exclusions), where Turla deployed LunarWeb installer files into directories excluded from scanning. The GBHackers report (2026-10-01) states real-world use in campaigns but names no specific current actor, victims, CVE, CVSS or network/file IOCs; severity is analyst-assigned.

Defender guidance from the sources: Tamper Protection does not prevent exclusion creation; DisableLocalAdminMerge (set to 1) makes Intune/policy settings take precedence over local-admin settings, though NVISO observed locally added PowerShell exclusions persisting until a restart or policy reapplication. Detection should monitor registry-level changes to the exclusion keys and to HideExclusionsFromLocalAdmins (works regardless of whether PowerShell, WMI, GPO or manual methods were used), baseline approved exclusions, and flag broad entries such as root-drive paths, temp directories, user-writable folders, Downloads, wildcard extensions and unexpected IP exclusions, correlating with PowerShell, WMI, Group Policy, credential-access or payload-staging activity.

## MITRE ATT&CK

- T1685 Disable or Modify Tools
- T1564.012 Hide Artifacts: File/Path Exclusions
- T1112 Modify Registry
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1047 Windows Management Instrumentation
- T1012 Query Registry

## Sources

- [Hackers Hide Microsoft Defender Exclusions From Admins to Evade Antivirus Scans (GBHackers)](https://gbhackers.com/microsoft-defender-exclusions/)
- [You Can Run, but You Can't Hide: Defender Exclusions (Huntress)](https://www.huntress.com/blog/you-can-run-but-you-cant-hide-defender-exclusions)
- [Defence Impairment Olympics (Huntress)](https://www.huntress.com/blog/mimikatz-credential-dumping-defence-impairment)
- [Threat Actor Defense Evasion: How Attackers Disable AV & EDR (Huntress)](https://www.huntress.com/blog/how-attackers-disable-av-edr)
- [MITRE ATT&CK T1562.001 Impair Defenses: Disable or Modify Tools](https://attack.mitre.org/techniques/T1562/001/)
- [MITRE ATT&CK T1564.012 Hide Artifacts: File/Path Exclusions](https://attack.mitre.org/techniques/T1564/012/)
- [Can we block the addition of local Microsoft Defender Antivirus exclusions? (NVISO)](https://blog.nviso.eu/2022/12/02/can-we-block-the-addition-of-local-microsoft-defender-antivirus-exclusions/)
- [Microsoft Defender weakness lets hackers bypass malware detection (BleepingComputer)](https://www.bleepingcomputer.com/news/security/microsoft-defender-weakness-lets-hackers-bypass-malware-detection/)
- [Huntress Labs on X: Microsoft Defender Antivirus exclusions](https://x.com/HuntressLabs/status/1869128447362281971)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2824