Detect File/Path Exclusions in Splunk
Adversaries may attempt to hide their file-based artifacts by writing them to specific folders or file names excluded from antivirus (AV) scanning and other defensive capabilities. AV and other file-based scanners often include exclusions to optimize performance as well as ease installation and legitimate use of applications. These exclusions may be contextual or hardcoded strings referencing specific folders and files assumed to be trusted. Adversaries typically perform a discovery phase first — enumerating existing exclusion paths via registry queries or Get-MpPreference — then stage payloads precisely in those excluded locations to bypass real-time scanning. Turla has been documented placing LunarWeb implant files in AV-excluded directories as part of long-term persistence operations against diplomatic targets.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Technique
- T1564 Hide Artifacts
- Sub-technique
- T1564.012 File/Path Exclusions
- Canonical reference
- https://attack.mitre.org/techniques/T1564/012/
SPL Detection Query
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
| eval TargetFilename_lower=lower(TargetFilename)
| eval isSuspiciousPath=if(
match(TargetFilename_lower,
"\\\\windows\\\\temp\\\\|\\\\softwaredistribution\\\\|\\\\windows\\\\winsxs\\\\|\\\\appdata\\\\local\\\\temp\\\\|\\\\inetpub\\\\logs\\\\|\\\\windows\\\\logs\\\\"),
1, 0)
| eval isSuspiciousExt=if(
match(TargetFilename_lower,
"\.exe$|\.dll$|\.bat$|\.ps1$|\.vbs$|\.hta$|\.js$|\.cmd$|\.scr$|\.msi$|\.cpl$|\.ocx$"),
1, 0)
| eval isLegitProcess=if(
match(lower(Image),
"svchost\.exe$|trustedinstaller\.exe$|wuauclt\.exe$|msiexec\.exe$|msmpeng\.exe$|wudfhost\.exe$|windefend\.exe$"),
1, 0)
| where isSuspiciousPath=1 AND isSuspiciousExt=1 AND isLegitProcess=0
| eval SuspicionScore=isSuspiciousPath + isSuspiciousExt
| eval FilenameOnly=mvindex(split(TargetFilename, "\\"), -1)
| table _time, host, User, Image, CommandLine, TargetFilename, FilenameOnly, SuspicionScore
| sort - _timeDetects executable and script file creation in known Windows Defender default exclusion paths using Sysmon EventCode 11 (FileCreate). Evaluates each file creation event against a list of suspicious paths and extensions, excluding known legitimate system droppers (Windows Update, TrustedInstaller, MSI engine). SuspicionScore provides prioritization. For the adversary discovery phase (registry queries of exclusion keys), supplement this query with Security Event ID 4657 (if object access auditing is enabled on the Defender exclusion registry keys) or use Microsoft Defender for Endpoint DeviceRegistryEvents in the KQL variant of this detection.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Windows Update agent writing packages to SoftwareDistribution — filter by Image matching wuauclt.exe or WUDFHost.exe
- Software installers extracting components to %TEMP% during application setup — filter by msiexec.exe or signed installer parent processes
- Security vendor self-updates writing new agent versions to self-excluded directories
- Developer build pipelines outputting compiled artifacts to temp directories configured as AV exclusions
- Enterprise management agents (SCCM, Intune MDM) staging software packages in excluded paths before deployment
Other platforms for T1564.012
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Enumerate Windows Defender Exclusion Paths via Registry Query
Expected signal: Security Event ID 4657 (if SACL auditing is configured on Defender exclusion keys): ObjectName matching 'Windows Defender\Exclusions', ProcessName=reg.exe. DeviceRegistryEvents in MDE: ActionType=RegistryKeyQueried, RegistryKey containing 'Windows Defender\Exclusions', InitiatingProcessFileName=reg.exe. Sysmon Event ID 1: Process Create with Image=reg.exe and CommandLine containing 'Windows Defender\Exclusions\Paths'.
- Test 2Enumerate Defender Exclusions via PowerShell Get-MpPreference and Stage Payload
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe and CommandLine containing 'Get-MpPreference'. PowerShell ScriptBlock Log Event ID 4104: Full script captured including Get-MpPreference call and Set-Content file write. DeviceRegistryEvents in MDE: RegistryValueRead on Defender exclusion paths by powershell.exe. Sysmon Event ID 11: FileCreate for argus-t1564012-test.ps1 in the exclusion path with Image=powershell.exe.
- Test 3Stage Executable Payload in Windows SoftwareDistribution (Default AV Exclusion)
Expected signal: Sysmon Event ID 11: FileCreate with TargetFilename=C:\Windows\SoftwareDistribution\argus-t1564012-payload.exe and Image=cmd.exe. DeviceFileEvents in MDE: ActionType=FileCreated, FolderPath containing 'SoftwareDistribution', FileName=argus-t1564012-payload.exe, InitiatingProcessFileName=cmd.exe. SHA256 will match notepad.exe (benign hash) but the location is anomalous — demonstrates why path-based detection is essential for this technique.
- Test 4Execute Staged Payload from Exclusion Path (Full Attack Chain Validation)
Expected signal: Sysmon Event ID 11: FileCreate for argus-t1564012-exec.ps1 in C:\Windows\Temp with Image=cmd.exe. Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine referencing C:\Windows\Temp\argus-t1564012-exec.ps1, ParentImage=cmd.exe. PowerShell ScriptBlock Log Event ID 4104: Captures the script content. DeviceProcessEvents in MDE: FolderPath=C:\Windows\Temp, FileName=powershell.exe, ProcessCommandLine containing 'argus-t1564012-exec.ps1'.
References (9)
- https://attack.mitre.org/techniques/T1564/012/
- https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/configure-contextual-file-folder-exclusions-microsoft-defender-antivirus
- https://learn.microsoft.com/en-us/defender-endpoint/configure-exclusions-microsoft-defender-antivirus
- https://www.welivesecurity.com/en/eset-research/turla-lunar-toolset/
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-devicefileevents-table
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceregistryevents-table
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1564.012/T1564.012.md
- https://learn.microsoft.com/en-us/powershell/module/defender/get-mppreference
- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4657
Unlock Pro Content
Get the full detection package for T1564.012 including response playbook, investigation guide, and atomic red team tests.