Detecting and Mitigating Selective Exclusion (MITRE ATT&CK T1679)

Selective Exclusion (T1679) describes malware that deliberately leaves some files, folders or components alone. MITRE places it in the Stealth tactic and lists Windows as the platform.

How attackers use it

During a ransomware or other destructive payload, an adversary may exclude certain files, folders, directories, file types or system components from encryption or tampering. MITRE notes extensions that may be avoided include .dll, .exe and .lnk.

The reasons are practical:

• To avoid alerting users.
• To evade security tools and analysts.
• In the case of ransomware, to keep the system running well enough to show the ransom notice.

MITRE adds that exclusions often target files whose corruption would cause instability, break core services or expose the attack straight away. By avoiding them, the adversary keeps the system responsive and produces fewer indicators.

The technique page includes examples of malware that skips system and program directories such as System32, Windows, Program Files, Boot and the Recycle Bin, that avoids files using a regular expression built into the binary, that avoids specific file names, and that checks whether a host is a domain controller and leaves it alone if so.

For defenders, this explains why a ransomware victim can still open the machine and read the note. The system was left alive on purpose.

How to detect it

MITRE's detection strategy has two angles:

• A process with no prior history, or one outside known approved tools, that changes files or the registry to set exclusion rules for antivirus, backup or file-handling systems.
• File system enumeration that looks for specific file names and critical extensions such as .dll, .exe or .sys, or for directories such as Program Files or security tool paths. System component discovery used to decide what to exclude counts too.

The first angle is the more actionable. A new process editing antivirus or backup exclusions is rare in a healthy environment and worth an alert.

Because ransomware does its damage fast, this detection needs to reach a person or an automated response quickly. Watching for the setup, such as exclusion changes and wide directory enumeration, gives more lead time than watching for the encryption itself.

How to reduce the risk

MITRE lists no formal mitigation. Practical steps that follow from the detection guidance:

• Restrict who can change antivirus and backup exclusion settings, and log every change.
• Alert on exclusions added by anything other than your management tooling.
• Keep offline or immutable backups, so that a machine left running does not mean data left safe.
• Test recovery from backup on a regular schedule.

Check your own environment

On Windows, with Microsoft Defender, this read-only PowerShell command lists configured exclusions. Run it in an elevated session:

Get-MpPreference | Select-Object ExclusionPath, ExclusionExtension, ExclusionProcess

Then ask:

• Does every exclusion have an owner and a reason?
• Are backup agents excluded from file monitoring for good reason, or only for convenience?
• Do you receive an alert when exclusions change?
• Have you restored a system from backup in the last quarter?

Quick check

Sources

• MITRE ATT&CK, Selective Exclusion (T1679): https://attack.mitre.org/techniques/T1679