# Defender Exclusion Abuse: How Attackers Hide Malware from MDAV

Attackers abuse MDAV exclusion settings and HideExclusionsFromLocalAdmins to blind Defender scans and hide exclusions from admins, used by GootKit, WhisperGate, Muddled Libra.

- Payout: Real-world hack
- Severity: medium
- Program: Microsoft Defender Antivirus
- Analysis by: Huntress
- Disclosed: 2026-09-30
- Write-up quality: 6/10
- Original: https://www.huntress.com/blog/you-can-run-but-you-cant-hide-defender-exclusions
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-you-can-run-but-you-cant-hide-defender-exclusions
- Tags: area:os domain:desktop impact:integrity impact:privesc kind:incident platform:threat-intel sev:medium tech:windows technique:source-review vuln:access-control vuln:info-disclosure vuln:misconfiguration

**Target:** Windows Defender Antivirus exclusion policy (registry/WMI/GPO)
**Root cause:** MDAV honors Path/Extension exclusions that remove matching paths from real-time, scheduled and on-demand scans; the HideExclusionsFromLocalAdmins policy value suppresses exclusion visibility to admins and SYSTEM via normal query APIs.
**Steps:**
1. Set exclusion via PowerShell: `Set-MpPreference -ExclusionPath C:\Temp` or `Add-MpPreference -ExclusionPath C:\Temp`
2. Or via WMI: `Invoke-CimMethod -Namespace root/Microsoft/Windows/Defender -ClassName MSFT_MpPreference -MethodName Add -Arguments @{ExclusionPath=@("C:\Temp"); ...}`
3. Or via GPO: Computer Configuration -> Administrative Templates -> Windows Components -> Microsoft Defender Antivirus -> Exclusions
4. Or direct registry (GPO key, needs reboot): `reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Temp" /t REG_SZ`
5. Hide exclusions: set `HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\HideExclusionsFromLocalAdmins`
6. Drop/execute malware in excluded path; scans skip it and `(Get-MpPreference).ExclusionPath` returns nothing
**How found:** Huntress endpoint team reviewed overlooked MDAV settings adversaries use to evade scans, traced exclusion write paths (PowerShell->WMI->COM/RPC->MsMpEng.exe->registry, and GPO svchost->Policies key) via ProcMon, then tested querying exclusions before/after setting HideExclusionsFromLocalAdmins at admin and SYSTEM levels.
**Exploitation:** Adversary with admin privileges adds a Path exclusion for the malware directory (GootKit via WMI, WhisperGate via Set-MpPreference on C:\, Muddled Libra), then sets HideExclusionsFromLocalAdmins so defenders querying exclusions via PowerShell see an empty list while the malware runs unscanned.
**Escalation:** Combining exclusion with HideExclusionsFromLocalAdmins defeats both scanning and admin visibility; admins must read the registry directly to recover the list.
**Insight:** Exclusions live in two registry hives (MsMpEng's Exclusions and the GPO Policies\...\Exclusions); detection should hook registry writes to both plus HideExclusionsFromLocalAdmins, and verify exclusion lists by reading the registry directly since query APIs can be suppressed.

## Proof of concept (copied exactly from the original report)

**PowerShell Set-MpPreference exclusion commands**

```
Set-MpPreference -ExclusionPath C:\Temp
Add-MpPreference: 
Add-MpPreference -ExclusionPath C:\Temp
```

**WMI MSFT_MpPreference Add exclusion method**

```
Invoke-CimMethod -Namespace root/Microsoft/Windows/Defender -ClassName MSFT_MpPreference -MethodName Add -Arguments @{ExclusionPath=@("C:\Temp"); ThreatIDDefaultAction_Ids=@([Int64]1,[Int64]2,[Int64]3,[Int64]10); ThreatIDDefaultAction_Actions=@([Byte]1, [Byte]2, [Byte]3, [Byte]10); Force=$true}
```

**Registry add GPO exclusion path**

```
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows 
Defender\Exclusions\Paths" /v "C:\Temp" /t REG_SZ
```