Attackers Exploit Microsoft Defender Antivirus Exclusions to Evade Detection

• •Attackers exploit MDAV exclusions to evade antivirus scans.
• •Path and extension exclusions are commonly abused by adversaries.
• •Organizations should tighten controls on administrative privileges.

Cyber adversaries are leveraging Microsoft Defender Antivirus (MDAV) exclusions to bypass security scans on malicious files. These exclusions allow users with administrative privileges to disable scans on specific files, folders, and processes, making it easier for attackers to hide malware. The Huntress team has identified that path and extension exclusions are particularly valuable for attackers, as they remove matching items from all types of scans. Microsoft supports four types of exclusions, but the misuse of these features poses a significant risk to organizations relying on MDAV for protection. Microsoft has not issued any patches or updates related to this issue, and the situation remains a concern for cybersecurity professionals. Organizations are advised to monitor exclusion settings closely and implement stricter controls on administrative privileges to mitigate this risk.