Full Report
Understand Windows Defender AntiVirus exclusions and how adversaries might leverage this capability to bypass scans.
Analysis Summary
# Tool/Technique: Microsoft Defender Antivirus (MDAV) Exclusions Evasion
## Overview
This technique involves the manipulation of Microsoft Defender Antivirus (MDAV) exclusion settings by an adversary. By adding malicious file paths, extensions, or processes to the exclusion list, attackers can ensure their tools and payloads remain unscanned by real-time protection, scheduled scans, and on-demand scans, effectively bypassing the antivirus without disabling the service entirely.
## Technical Details
- **Type:** Technique (Defense Evasion)
- **Platform:** Windows
- **Capabilities:**
- Bypasses real-time monitoring and scheduled scans.
- Supports exclusions based on **Path**, **Process**, **Extension**, and **IpAddress**.
- Stealthier than full AV termination.
- **First Seen:** Widely observed; specific campaign mentions include GootKit (2019) and WhisperGate (2022).
## MITRE ATT&CK Mapping
- **TA0005 - Defense Evasion**
- **T1562 - Impair Defenses**
- **T1562.001 - Impair Defenses: Disable or Modify Tools**
## Functionality
### Core Capabilities
- **Path Exclusions:** Prevents MDAV from scanning specific folders or files (e.g., excluding the entire `C:\` drive or a specific staging folder).
- **Process Exclusions:** Disables scanning for any file opened or manipulated by a specific (potentially malicious) process.
- **Extension Exclusions:** Allows any file with a specific extension (e.g., `.exe`, `.dll`, or custom extensions) to bypass scanning regardless of location.
- **IP Address Exclusions:** Disables network packet inspection for traffic originating from specific IP addresses.
### Advanced Features
- **WMI Integration:** Leverage the `MSFT_MpPreference` WMI class to programmatically change settings, which often bypasses simple command-line logging.
- **Registry Persistence:** Exclusions are stored in the registry, ensuring that even after a reboot, the malicious files remain unscanned.
- **GPO Manipulation:** Attackers with higher privileges can use Group Policy Objects to push exclusions across an entire domain.
## Indicators of Compromise
- **File Names:** `MsMpEng.exe` (showing unusual registry activity), `svchost.exe` (specifically the `gpsvc` service modifying Defender keys).
- **Registry Keys:**
- `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions` (Local settings)
- `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions` (Policy-based settings)
- **Behavioral Indicators:**
- Execution of `Set-MpPreference` or `Add-MpPreference` PowerShell cmdlets.
- Unexpected calls to the `MSFT_MpPreference` WMI class.
- Modification of Defender registry keys by processes other than `MsMpEng.exe` or `TrustedInstaller`.
## Associated Threat Actors
- **GootKit:** Known for using WMI to set path exclusions.
- **WhisperGate:** Used PowerShell to exclude the entire `C:\` drive during destructive operations in Ukraine.
- **Muddled Libra:** Observed leveraging exclusions in 2024 campaigns.
- **Cephalus Ransomware:** Associated with techniques to bypass endpoint protections.
## Detection Methods
- **Signature-based detection:** Monitoring for scripts containing strings like `Add-MpPreference -ExclusionPath`.
- **Behavioral detection:**
- Monitoring registry writes to the Windows Defender Exclusions keys.
- Alerting on `(Get-MpPreference).ExclusionPath` queries followed by modification attempts.
- Auditing WMI event logs for `MSFT_MpPreference` interactions.
- **Event Logs:** Monitoring Windows Event Log ID 4688 (Process Creation) for PowerShell commands modifying Defender preferences.
## Mitigation Strategies
- **Role-Based Access Control:** Limit administrative privileges; MDAV exclusions require elevated permissions.
- **Tamper Protection:** Enable Microsoft Defender "Tamper Protection" to prevent unauthorized changes to security settings.
- **GPO Hardening:** Use Group Policy to enforce a specific set of exclusions and prevent local overrides.
- **Attack Surface Reduction (ASR):** Implement ASR rules to block the execution of potentially obfuscated scripts that may call configuration cmdlets.
## Related Tools/Techniques
- **Defendnot:** A tool that uses undocumented APIs to bypass Defender.
- **DLL Sideloading:** Often used in conjunction with exclusions to run malicious code via legitimate binaries (e.g., SentinelOne/Cephalus).
- **Safe Mode Boot:** A related technique to disable security software entirely.