Every antivirus product has a list of places it will not look. MITRE T1564.012, File/Path Exclusions, is about adversaries dropping their files in those places. It is a stealth technique for Linux, macOS and Windows.
How attackers use it
AV and other file-based scanners carry exclusions to improve performance and make installation and legitimate use of applications easier. Some are contextual, such as scans that run only when triggered by an alert, but many are hardcoded folders or file names assumed to be trusted.
MITRE says that, instead of tampering with the tool to add a new exclusion, adversaries may write payloads into default or well-known exclusions. They may also use Security Software Discovery and other discovery activity to find and verify what a victim has excluded.
The point is subtle: no setting changed, so a configuration alert never fires.
How to detect it
MITRE's analytics all look at writes into excluded locations, combined with what happens next:
- Windows: file creation in directories known to be excluded, such as
C:\Windows\Temp, Exchange server directories or default AV exclusions, correlated with execution or unusual parent processes. - Linux: payloads written or moved into AV or EDR exclusion paths, for example
/tmp,/var/libor custom directories listed in auditd exclusion rules. - macOS: suspicious file creation in directories ignored by XProtect or AV, such as
~/Libraryor temporary cache directories.
An excluded folder is a place to monitor with something other than the AV, such as file creation events and process lineage.
How to reduce the risk
MITRE lists two mitigations:
- Antivirus/Antimalware: review and audit file and folder exclusions, and limit them to only what is required.
- Application Developer Guidance: limit the need for custom or hard-to-manage exclusions, and install applications into trusted system folders already protected by restricted permissions.
If an application vendor asks for a broad exclusion, ask for the narrowest path that works and record who approved it.
Check your own environment
On Windows with Microsoft Defender, a read-only listing (run as administrator):
Get-MpPreference | Select-Object ExclusionPath,ExclusionExtension,ExclusionProcess
Then ask of each entry: who requested it, is it still needed, and can unprivileged users write there? Do the same review in whatever product you use on Linux and macOS.
Quick check
Why does writing into an existing exclusion avoid a configuration alert?
Because no exclusion is added or changed. The adversary uses one that is already there.
