Disable or Modify Tools × Microsoft Defender Antivirus

Attackers are configuring Microsoft Defender exclusions to hide malicious directories and file types

After gaining administrative privileges, attackers add exclusions for directories or file extensions in Microsoft Defender settings. This prevents Defender from scanning those locations, allowing malware to persist and execute without detection while the antivirus appears active.

Monitor for changes to Defender exclusion lists via Event ID 5007 (Microsoft-Windows-Windows Defender/Operational) or registry keys under HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions. Alert on any exclusion additions, especially for suspicious paths or extensions, and enforce least privilege to limit admin access.