Attackers Can Conceal Microsoft Defender Exclusions From PowerShell Queries

This report explains how attackers abuse Microsoft Defender exclusions—particularly by setting the registry HideExclusionsFromLocalAdmins—so exclusions remain active but are invisible to PowerShell and the Windows Security UI, enabling malware to bypass detection; it cites examples (GootKit, WhisperGate, Muddled Libra), describes methods used to create exclusions, and recommends auditing exclusions, monitoring registry changes, restricting policy changes, and centralizing management.