# EDR and scan protection tampering Boot config, exclusion policy, or firewall rules that stop security agents from running or reporting _Area: Network devices and IoT. Seen in 3 disclosed reports; latest 2026-09-30. Updated 2026-11-03._ ## How it works Security agents are ordinary software that depends on the same OS mechanisms they are meant to watch. Three assumptions break: (1) an agent only runs if its drivers and services load at boot, so a boot mode that skips third-party drivers leaves the host unprotected; (2) the agent's own configuration (exclusions, visibility policy) is writable by whoever holds admin, so the scanner can be told to ignore paths and the admin can be told not to see that; (3) the agent's telemetry is just network traffic, so a host firewall or WFP filter can drop it. In each case the attacker never attacks the agent's logic — they remove the conditions it needs to run, scan, or report. ## Where it shows up - Boot configuration changes: `msconfig`, `bcdedit`, or writes under `HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\` registering a remote-access tool to survive Safe Mode [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-akira-hits-safe-mode-ransomware-rebooting-around-edr.md) - Defender exclusion writes via PowerShell/WMI/COM or GPO, and the `HideExclusionsFromLocalAdmins` policy value [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-you-can-run-but-you-cant-hide-defender-exclusions.md) - New firewall rules or WFP filters whose target is the security agent's process or ports [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-silencing-the-edr-silencers.md) - Registry persistence of the above: `FirewallRules` REG_SZ strings and WFP filter REG_BINARY blobs [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-silencing-the-edr-silencers.md) - Event log gaps: Kernel-Boot EID 27 (SAFEBOOT:NETWORK), Kernel-General EID 12 (BootMode=2), Defender EID 3002 (service cannot start in Safe Mode) [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-akira-hits-safe-mode-ransomware-rebooting-around-edr.md) ## How to review For each control, ask: can a local admin, or a boot-mode change, stop it from running, scanning, or reporting — and would anyone notice? The invariant: the agent must start in every boot mode the host can enter, its exclusion and visibility settings must be tamper-evident to a party other than the local admin, and its telemetry path must not be blockable by host-local rules without an alert. Check both exclusion hives (the engine's own and the GPO Policies key), not just the query API [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-you-can-run-but-you-cant-hide-defender-exclusions.md). Check that firewall/WFP rule creation targeting the agent is logged and alerted, since the rules themselves persist predictably [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-silencing-the-edr-silencers.md). ## How finders spotted it - Incident responders reconstructed a boot-mode evasion by correlating VPN logs, boot event IDs, and process trees (`msconfig`, `reg.exe` SafeBoot add, encryptor) rather than trusting the agent, which was silent [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-akira-hits-safe-mode-ransomware-rebooting-around-edr.md) - Endpoint researchers enumerated overlooked agent settings adversaries abuse, traced the write path with ProcMon, then tested querying exclusions before and after setting the hide policy at admin and SYSTEM levels [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-you-can-run-but-you-cant-hide-defender-exclusions.md) - A booth-talk observation that firewall rules are the most common blinding method led to noticing the attacker never touches the agent process, only its connectivity, then tracing where rules persist [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-silencing-the-edr-silencers.md) ## Variants seen - Boot-mode downgrade: Safe Mode with Networking skips EDR/AV but keeps network for exfil and detonation [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-akira-hits-safe-mode-ransomware-rebooting-around-edr.md) - Scan exclusion plus visibility suppression, defeating both scanning and admin review [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-you-can-run-but-you-cant-hide-defender-exclusions.md) - Host firewall/WFP rules blocking agent traffic so telemetry never reaches the server [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-silencing-the-edr-silencers.md) ## Impact and severity High: each variant yields a blind window on a live host. Safe Mode removed coverage host-wide while preserving network access, giving time to stage and launch the encryptor [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-akira-hits-safe-mode-ransomware-rebooting-around-edr.md). Exclusions combined with hiding defeated scanning and admin visibility, requiring direct registry reads to recover the list [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-you-can-run-but-you-cant-hide-defender-exclusions.md). Firewall blocking silences detection entirely because telemetry never arrives [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-silencing-the-edr-silencers.md). ## Seen in real software Open-source packages and projects, and products, where this pattern was found. If the target runs one, compare the version it runs with the fix. - **Microsoft Defender Antivirus** (exclusion policy (Path/Extension exclusions, HideExclusionsF) (version not stated): Defender Exclusion Abuse: How Attackers Hide Malware from MDAV. Report: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-you-can-run-but-you-cant-hide-defender-exclusions.md - **Microsoft Windows Defender Firewall** (firewall rules and Windows Filtering Platform filters) (version not stated): Silencing the EDR Silencers. Report: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-silencing-the-edr-silencers.md ## Evidence - E1: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-akira-hits-safe-mode-ransomware-rebooting-around-edr.md - E2: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-you-can-run-but-you-cant-hide-defender-exclusions.md - E3: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-silencing-the-edr-silencers.md