Loading story…
Attackers are modifying Microsoft Defender Antivirus exclusion settings to prevent malware from being scanned while leaving Defender enabled, evading real-time, scheduled, and on-demand protections. The technique requires administrator-level access and can be deployed through PowerShell, WMI, Group Policy, or direct policy-registry changes; broad path or file-extension exclusions can shield malware staging locations and payloads. Huntress linked the behavior to activity involving GootKit, WhisperGate, and Muddled Libra.
Defender policies can conceal configured exclusions from PowerShell queries, including those executed as SYSTEM, limiting the reliability of routine endpoint inspection. Security teams should monitor for newly created exclusions, especially exclusions covering entire drives, broad extensions, or staging directories, and investigate modifications to the HideExclusionsFromLocalAdmins policy. Incident responders should validate both local and Group Policy registry locations directly rather than relying solely on Defender or PowerShell output.
Get the actors, campaigns, and ATT&CK mapping behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Huntress linked the use of Microsoft Defender Antivirus exclusions to Muddled Libra activity, reflecting continued use of the technique after attackers gain elevated access.
Huntress associated WhisperGate activity with Microsoft Defender exclusion abuse, including an exclusion for the full C:\ drive that could shield malware from scanning.
Huntress linked abuse of Microsoft Defender Antivirus exclusion settings for defense evasion to GootKit activity.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ransomware operators have repeatedly used tools and policy abuse to disable Microsoft Defender before encrypting Windows environments. DFIR reporting documented the freeware utility **Defender Control** being used in real intrusions by groups such as **Dharma**, **Phobos**, and **Crysis**, typically after access through exposed RDP, to turn off Defender through registry edits, service changes, driver unloading, and local group policy modifications. Separately, **LockBit 2.0** automated the same objective at enterprise scale by creating malicious Active Directory group policies on a domain controller, disabling Defender across domain-joined systems, and launching ransomware via scheduled tasks after enumerating hosts with AD and LDAP queries. More recent intrusions show the tactic evolving beyond simple utilities into **BYOVD** and broader policy abuse. WithSecure reported that the **CrazyHunter** ransomware actor used the vulnerable **Zemana Anti-Logger** driver `zam64.sys` to disable both Windows Defender and Trend Micro during attacks on Taiwanese hospitals and industrial organizations, including the Mackay Memorial Hospital incident. The operation also used publicly available tooling such as **SharpGPOAbuse** for lateral movement and persistence, reinforcing that defense evasion through Defender tampering and group policy manipulation remains a practical, low-barrier technique for ransomware actors ranging from smaller crews to more organized operators.
Aug 14, 2026
Elastic Security Labs’ analysis of roughly 100,000 Windows malware samples found **defense evasion** to be the most common ATT&CK tactic, followed by privilege escalation, execution, and persistence. Frequently observed behaviors included Windows Defender tampering, process injection, DLL side-loading, parent-PID spoofing, abuse of `Rundll32` and `Regsvr32`, malicious MSI installers, and NTDLL unhooking. Commodity malware increasingly used UAC-bypass techniques—including methods that abuse Windows’ trust in protected directories—alongside TrustedInstaller impersonation, elevated parent-process spoofing, and bring-your-own-vulnerable-driver activity. Security teams should prioritize behavioral detections for these elevation and evasion patterns, as well as monitoring for script hosts, WMI, scheduled tasks, Run keys, services, and credential-store access that commonly accompany malware execution and persistence.
Aug 26, 2026
Microsoft patched two actively exploited vulnerabilities in Microsoft Defender and related protection components, including **CVE-2026-41091**, a high-severity local privilege escalation flaw that can give an attacker **`NT AUTHORITY\SYSTEM`** privileges, and **CVE-2026-45498**, a medium-severity denial-of-service issue that can make Defender unavailable. The affected products include Microsoft Malware Protection Engine version **1.1.26030.3008 and earlier** and Microsoft Defender Antimalware Platform version **4.18.26030.3011 and earlier**, and both CVEs were added to CISA’s **Known Exploited Vulnerabilities** catalog due to active exploitation in the wild. Technical analysis of **CVE-2026-41091**, dubbed **RedSun**, says the bug lies in Windows Defender’s file remediation workflow when it processes malicious files marked as Cloud Files placeholders. A standard user can abuse Defender’s SYSTEM-level file operations, together with **NTFS junctions** and **oplocks**, to redirect a privileged write into **`C:\Windows\System32`**, plant a malicious binary such as **`TieringEngineService.exe`**, and then trigger execution through Storage Tiers Management COM activation to obtain a SYSTEM shell. Microsoft said the issues were fixed through automatic updates and urged organizations that disable auto-updates to manually update Defender and any products using the same engine and platform components.
Jul 24, 2026