T1564.012

Description from ATT&CK

Adversaries may attempt to hide their file-based artifacts by writing them to specific folders or file names excluded from antivirus (AV) scanning and other defensive capabilities. AV and other file-based scanners often include exclusions to optimize performance as well as ease installation and legitimate use of applications. These exclusions may be contextual (e.g., scans are only initiated in response to specific triggering events/alerts), but are also often hardcoded strings referencing specific folders and/or files assumed to be trusted and legitimate.(Citation: Microsoft File Folder Exclusions)

Adversaries may abuse these exclusions to hide their file-based artifacts. For example, rather than tampering with tool settings to add a new exclusion (i.e., Disable or Modify Tools), adversaries may drop their file-based payloads in default or otherwise well-known exclusions. Adversaries may also use Security Software Discovery and other Discovery/Reconnaissance activities to both discover and verify existing exclusions in a victim environment.

Source

Atomic Tests

• Atomic Test #1: Stage and execute a payload from a Windows Defender excluded path

Atomic Test #1: Stage and execute a payload from a Windows Defender excluded path

Writes an executable payload into a directory that is excluded from Microsoft Defender scanning and executes it from that location. Rather than modifying tool settings to create a new exclusion, adversaries may place file-based payloads in existing default or otherwise well-known exclusions so that the artifact is never scanned.

A copy of a benign signed binary (calc.exe) is used as the payload so that no malicious content is written to disk.

Upon successful execution, the payload is copied into the excluded directory and launched from there.

Supported Platforms: Windows

auto_generated_guid: 0303c07b-545e-4c0b-89f4-aea84a7a8d8e

Inputs

Attack Commands: Run with powershell!

Copy-Item "#{payload_source}" -Destination "#{excluded_path}\#{payload_name}" -Force
Start-Process "#{excluded_path}\#{payload_name}"

Cleanup Commands

$payloadProcess = [System.IO.Path]::GetFileNameWithoutExtension("#{payload_name}")
Stop-Process -Name $payloadProcess -Force -ErrorAction SilentlyContinue
Remove-Item "#{excluded_path}\#{payload_name}" -Force -ErrorAction SilentlyContinue
$markerPath = Join-Path "#{excluded_path}" ".art-created-defender-exclusion"
if (Test-Path $markerPath) {
  Remove-Item $markerPath -Force -ErrorAction SilentlyContinue
  Remove-MpPreference -ExclusionPath "#{excluded_path}" -ErrorAction SilentlyContinue
  Remove-Item "#{excluded_path}" -Force -ErrorAction SilentlyContinue
}

Dependencies: Run with powershell!

Description: An excluded directory (#{excluded_path}) must exist and be present in the Defender

exclusion list. Adding a Defender exclusion requires administrative privileges and fails when Tamper Protection is enabled.

Check Prereq Commands

if ((Get-MpPreference).ExclusionPath -contains "#{excluded_path}") {exit 0} else {exit 1}

Get Prereq Commands

$markerPath = Join-Path "#{excluded_path}" ".art-created-defender-exclusion"
New-Item -ItemType Directory "#{excluded_path}" -Force | Out-Null
Add-MpPreference -ExclusionPath "#{excluded_path}" -ErrorAction Stop
New-Item -ItemType File $markerPath -Force | Out-Null

Description: The payload source (#{payload_source}) must exist on disk.

Check Prereq Commands

if (Test-Path "#{payload_source}") {exit 0} else {exit 1}

Get Prereq Commands

Write-Host "The payload source must already exist at #{payload_source}."

Atomic test(s) for this technique last updated: 2026-08-28 01:43:09 UTC