You Can Run, but You Can’t Hide: Defender Exclusions | Huntress

Huntress details how attackers leverage Microsoft Defender Antivirus exclusions (path/extension) set via PowerShell, WMI, GPO, or registry to bypass scans and evade detection—citing campaigns like GootKit, WhisperGate, and Muddled Libra—and highlights a HideExclusionsFromLocalAdmins registry setting that can conceal exclusions; Huntress added registry telemetry and detection rules for suspicious exclusions and the hide flag.