# Microsoft Defender Antivirus Exclusion Abuse: Attackers Set and Hide Exclusions (HideExclusionsFromLocalAdmins) to Evade MDAV

> Huntress documents how attackers holding admin/SYSTEM rights add Microsoft Defender Antivirus exclusions via PowerShell, WMI, Group Policy or registry so malware escapes scanning, and set the HideExclusionsFromLocalAdmins registry value to conceal those exclusions from local administrators. The technique has prior in-the-wild use by GootKit (2019), WhisperGate (2022) and Muddled Libra (2024).

- **Published:** 2026-10-01T00:00:00Z
- **Last reviewed:** 2026-10-01T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2828
- **ID:** TL-2026-2828
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 9 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Microsoft Defender Antivirus (MDAV) supports four exclusion types: Process (no real-time scanning of files opened by a given process), Path (entire paths skipped by real-time and scheduled scans), Extension (file extensions skipped) and IpAddress (network packet inspection skipped for a given IP). Any actor with local administrator or SYSTEM privileges can abuse these to create a blind spot for payloads, tooling and staging directories.

Huntress (Jonathan Johnson, 2026-09-30) describes four ways exclusions are written. (1) PowerShell: Set-MpPreference / Add-MpPreference -ExclusionPath (e.g. C:\Temp), which route through the MSFT_MpPreference WMI class, COM/RPC and the MsMpEng.exe service. (2) WMI directly: Invoke-CimMethod against namespace root/Microsoft/Windows/Defender, class MSFT_MpPreference, method Add, with an ExclusionPath argument (plus ThreatIDDefaultAction arguments and Force=$true). (3) Group Policy: Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Exclusions, applied by the gpsvc svchost and stored under HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions. (4) Direct registry modification of the policy key (e.g. reg add of a value under ...\Exclusions\Paths), which requires a reboot or policy refresh to take effect. Direct writes to the MDAV-owned key HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions are protected by MDAV and not feasible from userland.

To conceal the exclusions, attackers can set the HKLM\SOFTWARE\Policies\Microsoft\Windows Defender HideExclusionsFromLocalAdmins value (REG_DWORD = 1). This does not remove or block exclusions; it stops local administrators from enumerating them through Get-MpPreference, the Windows Security app and the registry editor view, so a responder or admin running standard queries sees an empty list. Per NVISO (2022), Tamper Protection and DisableLocalAdminMerge do not stop an admin from adding exclusions, so detection (not prevention) is the control.

Historical use cited by Huntress: GootKit (2019) used a UAC bypass and WMI/WMIC to add a path exclusion for its own executable; WhisperGate (2022) used PowerShell Set-MpPreference -ExclusionPath 'C:\' (and AdvancedRun.exe to stop the Defender service) before its wiper stages; Muddled Libra (2024) is cited by Unit 42 as using Defender exclusions. The source contains no CVE, no CVSS, no network IOCs and no named victims, so severity is analyst-assigned.

## MITRE ATT&CK

- T1685 Disable or Modify Tools
- T1564.012 File/Path Exclusions
- T1112 Modify Registry
- T1059.001 PowerShell
- T1047 Windows Management Instrumentation
- T1484.001 Group Policy Modification
- T1548.002 Bypass User Account Control

## Sources

- [You Can Run, but You Can't Hide: Defender Exclusions (Huntress)](https://www.huntress.com/blog/you-can-run-but-you-cant-hide-defender-exclusions)
- [Can we block the addition of local Microsoft Defender Antivirus exclusions? (NVISO)](https://blog.nviso.eu/2022/12/02/can-we-block-the-addition-of-local-microsoft-defender-antivirus-exclusions/)
- [Configure exclusions in Microsoft Defender Antivirus (Microsoft Learn)](https://learn.microsoft.com/en-us/defender-endpoint/configure-exclusions-microsoft-defender-antivirus)
- [Ukraine Cyber Conflict: WhisperGate (Unit 42)](https://unit42.paloaltonetworks.com/ukraine-cyber-conflict-cve-2021-32648-whispergate)
- [Threat Group Assessment: Muddled Libra (Unit 42)](https://unit42.paloaltonetworks.com/threat-group-assessment-muddled-libra-2024/)
- [GootKit Malware Bypasses Windows Defender by Setting Path Exclusions](https://cyware.com/news/gootkit-malware-bypasses-windows-defender-by-setting-path-exclusions-77dea8bb)
- [MITRE ATT&CK S0689: WhisperGate](https://attack.mitre.org/software/S0689/)
- [Splunk Research: PowerShell Windows Defender Exclusion Commands](https://research.splunk.com/endpoint/907ac95c-4dd9-11ec-ba2c-acde48001122/)
- [Sigma: Windows Defender Exclusion List Modified (registry)](https://detection.fyi/sigmahq/sigma/windows/builtin/security/win_security_windows_defender_exclusions_registry_modified/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2828