Security News Hackers Abuse Microsoft Defender Exclusions to Hide Malware From Antivirus Scans
-
Thread starter
Parkinsond
- Start date
- 11 Replies
- 1,117 Views
Checking for WD exclusions is seriously complicated... 
It’s close to impractical or impossible for typical consumers.
It’s close to impractical or impossible for typical consumers.
I used to check the exclusions once daily, but according to the article, there might be some without being dispalyed in Windows security.Checking for WD exclusions is seriously complicated...
I used Duck's ChatGPT to make suggestions for consumers:
You’re right—the full forensic approach is too complicated for most people. Consumers should use a risk-based shortcut, not try to audit every possible Defender configuration manually.
A practical approach is:
If all four fields are empty, that is a reasonable consumer-level check—not an absolute forensic guarantee.
If you’re concerned about the article’s concealment scenario, check:
If that returns `1`, or if the computer is managed by a workplace or school, don’t assume an empty exclusion list means the system is clean.
Go to Windows Security → Virus & threat protection → Scan options → Microsoft Defender Offline scan. This restarts the PC and scans before normal Windows processes load, making it harder for active malware to interfere.
The important distinction is:
A practical approach is:
1. Check the normal Defender exclusions list
Open Windows Security → Virus & threat protection → Manage settings → Exclusions. Remove anything you don’t recognize.2. Run one elevated PowerShell command
Code:
Get-MpPreference | Select-Object ExclusionPath,ExclusionExtension,ExclusionProcess,ExclusionIpAddressIf all four fields are empty, that is a reasonable consumer-level check—not an absolute forensic guarantee.
3. Check whether exclusions are being hidden
Code:
Get-MpPreference | Select-Object DisableLocalAdminMergeIf you’re concerned about the article’s concealment scenario, check:
Code:
Get-ItemProperty `
'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' `
-Name HideExclusionsFromLocalAdmins `
-ErrorAction SilentlyContinueIf that returns `1`, or if the computer is managed by a workplace or school, don’t assume an empty exclusion list means the system is clean.
4. Use Microsoft Defender Offline scan if anything looks suspicious
Go to Windows Security → Virus & threat protection → Scan options → Microsoft Defender Offline scan. This restarts the PC and scans before normal Windows processes load, making it harder for active malware to interfere.
5. Use a second-opinion scanner
Run an on-demand scan with a reputable, up-to-date security product. A second scanner is generally more useful to a typical consumer than manually investigating every possible registry and policy path.The important distinction is:
- Ordinary home user: Windows Security check + PowerShell check + Offline scan if concerned.
- Work/school computer: Ask the administrator; policies may intentionally configure exclusions.
- Evidence of compromise: Disconnect from the internet and use professional incident-response help (
) rather than trying to prove the machine is clean manually.
Andy Ful
From Hard_Configurator Tools
Verified
Honorary Member
Top Poster
Developer
Well-known
Forum Veteran
If the policy HideExclusionsFromLocalAdmins is set in the system, you can see this when checking exclusions via Security Center (the text in red):
Last edited:
Yes I have tried before; exclusion section get disabled in Windows security.
But is it a guarantee no exclusions can be added by malware through registry?
Andy Ful
From Hard_Configurator Tools
Verified
Honorary Member
Top Poster
Developer
Well-known
Forum Veteran
You do not get the information that "exclusion section get disabled" but that "You do not have the proper permissions to view ...". This is specific info related to the HideExclusionsFromLocalAdmins policy.
When this policy is set, Malware can add exclusions and you cannot see them via PowerShell or Security Center.
I created ConfigureDefenderPM to prevent attacks reported in the article.
Last edited:
How reassuring to know; thank you, Andy.
I understand that there are incredibly talented people in these forums who can build tools and fixes to improve software like Microsoft Defender. But seriously, how is it that Microsoft with its enormous revenue, resources, and engineering teams still can’t seem to get these basic issues under control? At some point, you have to wonder what exactly all that money is being spent on. Windows Defender is constantly making headlines for vulnerabilities, bugs, and problems that the community somehow manages to identify, work around, or improve upon. If independent developers with a fraction of Microsoft’s resources can build tools to address these issues, why is Microsoft apparently struggling to do the same? You’d think a company with virtually unlimited resources would have figured this out by now they just dont care it seems...
Most used anti virus means it has the most people trying to find vulnerabilities, if Bitdefender or Avast for example had the largest market share the same thing would be happening.
They don't want the average Joe messing with settings that tools like Configure Defender or DefendeUI use.
They are not trying. One of the reasons is they have let others play in the playing field or else they would be accused of being a monopoly. If they put in their best effort then there will be no after market.
Last edited:
Ohhh no, whatever will the world do without giant companies like Gen Digital constantly bombarding users with upsells, manufactured urgency, and a healthy dose of scare tactics? Truly, a devastating loss for capitalism as we know it.
Don't get me wrong, I still love our third-party products. Aside from Defender, Malwarebytes has always held a special place in my heart.Recently browsing
Members who viewed this thread in the last 5 minutes
You may also like...
-
-
-
Setup Idea Pretty Good PC Security Regimen -
Serious Discussion Orion Malware Cleaner (OMC) - By Trident -
