🔴 Hackers Hide Microsoft Defender Exclusions From Admins to Evade Antivirus Scans

Threat actors are increasingly abusing Microsoft Defender Antivirus exclusions to keep malicious files outside the reach of endpoint scans, and a little-known policy setting can conceal those exclusions from administrators using normal management tools.

Huntress researchers found that attackers can combine broad Defender exclusions with the HideExclusionsFromLocalAdmins setting, creating a stealthy defense-evasion path that leaves malicious activity unscanned while obscuring evidence of the change.

Microsoft Defender Antivirus (MDAV) exclusions are legitimate administrative controls intended to prevent performance or compatibility problems for trusted software.