T1679

Selective Exclusion

Defense Evasion Last updated:

This detection identifies adversaries employing selective exclusion during ransomware or destructive payload execution, where specific file extensions, directories, or system components are deliberately skipped to maintain system stability, evade detection, and ensure ransom delivery. Key indicators include script interpreter processes enumerating files with extensive system extension exclusion lists (.dll, .exe, .lnk, .sys, .msi), command-line arguments embedding regex patterns targeting multiple Windows critical extensions, explicit PowerShell exclusion operators (-notmatch, -notlike, -notcontains) filtering system file types, and mass file operation patterns that selectively skip binary and system formats. Ransomware families including Medusa, Embargo, and InvisibleFerret employ this technique to avoid system instability while maximizing encryption coverage, ensuring the victim endpoint remains operational enough to display ransom demands.

What is T1679 Selective Exclusion?

Selective Exclusion (T1679) maps to the Defense Evasion tactic — the adversary is trying to avoid being detected in MITRE ATT&CK.

This page provides production-ready detection logic for Selective Exclusion, covering the data sources and telemetry it touches: Microsoft Defender for Endpoint. The queries below are rated high severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Defense Evasion
Technique
T1679 Selective Exclusion
Canonical reference
https://attack.mitre.org/techniques/T1679/
Microsoft Sentinel / Defender
kusto 
DeviceProcessEvents
| where TimeGenerated > ago(1h)
| where FileName in~ ("powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "cmd.exe", "mshta.exe")
| where ProcessCommandLine matches regex @"(?i)(\.(dll|exe|lnk|sys|msi|bat|cmd|ini|url|drv|ocx|pif|com).*){3,}"
    or ProcessCommandLine matches regex @"(?i)(exclu|skip|avoid|ignore|bypass).{0,60}\.(dll|exe|lnk|sys|msi)"
    or ProcessCommandLine matches regex @"(?i)(-notmatch|-notlike|-notcontains|-notin|-ne).{0,80}\.(dll|exe|lnk|sys)"
| extend ExtensionCount = array_length(extract_all(@"(?i)\.(dll|exe|lnk|sys|msi|bat|cmd|ini|url|drv|ocx|pif|com)", ProcessCommandLine))
| where ExtensionCount >= 3
| extend ExclusionIndicatorType = case(
    ProcessCommandLine matches regex @"(?i)(exclu|skip|avoid|ignore|bypass)", "ExplicitExclusionKeyword",
    ProcessCommandLine matches regex @"(?i)(-notmatch|-notlike|-notcontains|-notin)", "PowerShellExclusionOperator",
    ProcessCommandLine matches regex @"(?i)(\.(dll|exe|lnk|sys|msi).*){4,}", "MultipleSystemExtensions",
    "Other"
  )
| project TimeGenerated, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, ExtensionCount, ExclusionIndicatorType
| order by ExtensionCount desc

Detects scripting interpreter processes (PowerShell, WScript, CScript, CMD, MSHTA) executing with command-line arguments containing three or more Windows system file extensions (.dll, .exe, .lnk, .sys, .msi, etc.) or explicit exclusion keywords and operators, indicative of ransomware selective exclusion logic executed via script. Classifies detections by exclusion indicator type for analyst triage prioritization.

high severity medium confidence

Data Sources

Microsoft Defender for Endpoint

Required Tables

DeviceProcessEvents

False Positives

  • Legitimate backup agent scripts (Veeam, Commvault, Veritas) that enumerate file systems while excluding binary extensions from backup scope
  • Software deployment automation (SCCM, PDQ Deploy, Ansible) that iterates files while targeting specific document types and skipping executables
  • IT administration PowerShell scripts performing selective file operations during maintenance windows
  • Security scanner scripts that explicitly exclude certain file types from scanning scope to reduce load
  • Developer build and packaging scripts that process source files while explicitly skipping compiled outputs (.exe, .dll)

Sigma rule & cross-platform mapping

The detection logic for Selective Exclusion (T1679) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1679 Sigma rules on detection.fyi

Platform-specific guides for T1679

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-03-20 Research depth: deep
References (2)

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1PowerShell Selective File Exclusion with -notcontains Operator

    Expected signal: Sysmon EventCode=1 with Image ending in powershell.exe, CommandLine containing .dll, .exe, .lnk, .sys, .msi, .bat, .cmd, .ini, .url, .drv extensions and -notcontains operator

  2. Test 2Embargo-Style Regex-Based Extension Exclusion Pattern

    Expected signal: Sysmon EventCode=1 with Image=powershell.exe, CommandLine containing regex pattern referencing dll|exe|lnk|sys|msi|bat|cmd|ini|url|drv|ocx|pif|com and -notmatch operator

  3. Test 3CMD Batch Script Selective File Targeting with Multiple IF NOT Conditions

    Expected signal: Sysmon EventCode=1 with Image=cmd.exe, CommandLine containing .dll, .exe, .sys, .lnk, .msi, .bat in multiple IF NOT conditional statements

  4. Test 4InvisibleFerret-Style Path and Extension Avoidance Enumeration

    Expected signal: Sysmon EventCode=1 with Image=powershell.exe, CommandLine containing avoidExtensions array with 12 system extensions, avoidPaths array, -notcontains and -like operators, Get-ChildItem cmdlet

Response Playbook

Triage

  1. Step 1: Record the full process context — FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, AccountName, and DeviceName. Determine immediately whether the binary lives in a standard installation directory (C:\Program Files, C:\Windows) or an anomalous path (TEMP, AppData, Downloads, ProgramData, root of a user profile).
  2. Step 2: Query DeviceProcessEvents for the same host over the prior 30 minutes to reconstruct the process chain. Check whether the triggering process was spawned by a known ransomware precursor: cmd.exe launched from a phishing document, PowerShell running from an Office macro, or an unusual parent such as explorer.exe or a browser.
  3. Step 3: Cross-reference DeviceFileEvents for the same host within the alert window. Look for file modification volumes exceeding 50 files in 5 minutes with non-system extensions, or creation of files with non-standard extensions (e.g., .encrypted, .medusa, .embargo, .locked). Presence confirms active encryption in progress.
  4. Step 4: Check DeviceRegistryEvents on the same host for ransomware preparation artifacts: writes to HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon (auto-run), modifications to boot configuration (bcdedit), or deletion of shadow copies (vssadmin). These co-occurring events escalate confidence significantly.
  5. Step 5: Review DeviceNetworkEvents for outbound connections from the triggering process or its parent within the 15-minute window. Identify any connections to external IPs on non-standard ports or to known malicious infrastructure — ransomware often exfiltrates or beacons before or during encryption for double extortion.
  6. Step 6: Assess the exclusion indicator type from the detection: 'ExplicitExclusionKeyword' and 'PowerShellExclusionOperator' types represent higher confidence than 'MultipleSystemExtensions' alone. Cross-check the ExtensionCount or total_ext_refs value — counts of 6 or more in a single command line are strongly anomalous for legitimate tools.

Containment

  1. If active encryption is confirmed via DeviceFileEvents or visual inspection, immediately isolate the endpoint using Microsoft Defender for Endpoint's Isolate Device action (or equivalent EDR containment) to sever all network connectivity while preserving the system for forensic analysis.
  2. Disable the affected user account in Azure AD or on-premises Active Directory to prevent credential reuse and lateral movement using the same identity. Document the account suspension time for the incident timeline.
  3. Identify and snapshot or disconnect any network shares currently mounted by the affected host. Query DeviceNetworkEvents for SMB connections (port 445) and notify share owners to check for encrypted files on shared drives.
  4. Block the malicious binary hash (SHA256) enterprise-wide through Defender for Endpoint or your EDR platform's threat intelligence feed integration to prevent execution on other endpoints that may have received the same payload.
  5. If the process is still running, use Task Manager or 'Stop-Process' via remote PowerShell to terminate it — but only after capturing a memory dump (WinPMem or procdump.exe) to preserve in-memory encryption keys or config data for forensic analysis.

Evidence Collection

  1. Export Windows Security Event Log and Sysmon operational logs (evtx) from the affected endpoint for a 2-hour window surrounding the alert time — include both before (to capture initial access) and after (to capture full ransomware execution).
  2. Collect the binary identified in the alert: full file path, MD5/SHA1/SHA256 hashes, PE metadata (compile timestamp, imports, exports), and embedded string output from 'strings.exe' or Sysinternals Strings. Look for embedded exclusion lists in the strings output.
  3. Check for dropped configuration files: ransomware families like Embargo use external config files containing exclusion regex patterns — search for JSON, INI, XML, or TXT files created in the same directory as the malicious binary within 5 minutes of its execution.
  4. Extract PowerShell artifacts: $env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt, PowerShell transcript logs (if Module Logging or Transcription is enabled), and Script Block Logging events (Event ID 4104 in Microsoft-Windows-PowerShell/Operational).
  5. Collect prefetch files (C:\Windows\Prefetch\) for the ransomware binary — prefetch records the first 8 seconds of file accesses and reveals which files the binary opened, confirming the exclusion scope.
  6. Run VSS enumeration ('vssadmin list shadows') before any remediation to document the pre-attack snapshot state. If shadows are already deleted, record the absence and correlate with vssadmin.exe execution in the process logs.
  7. Generate an MFT snapshot using a forensic tool (FTK Imager, Velociraptor) to document the exact set of encrypted files by extension and modification timestamp, providing scope information for business impact assessment.

Escalation Criteria

  • ! Escalate immediately if DeviceFileEvents confirms encrypted files with non-standard extensions on the affected host — active ransomware execution is confirmed and incident response team engagement is mandatory.
  • ! Escalate if the same selective exclusion pattern appears on more than 3 endpoints within a 1-hour window, indicating active lateral spread of a ransomware campaign rather than an isolated infection.
  • ! Escalate if DeviceNetworkEvents or network logs show outbound data transfers (large volumes to external IPs) within 30 minutes preceding the alert — this indicates potential double extortion via data theft before encryption.
  • ! Escalate if the alert affects a domain controller, file server, or backup infrastructure host — these targets represent disproportionate blast radius and require immediate CISO-level notification.
  • ! Escalate if co-occurring alerts for T1490 (shadow copy deletion via vssadmin) or T1486 (data encrypted for impact) fire on the same host within 30 minutes of this alert — the combined pattern indicates advanced ransomware execution with full preparation chain.

Investigation Guide

Forensic Artifacts

  • > Ransomware binary strings containing extension exclusion lists (.dll, .exe, .sys, .lnk visible in PE data sections via strings analysis)
  • > External JSON, INI, or XML configuration files dropped alongside ransomware binary containing exclusion regex patterns
  • > PowerShell Script Block Logging events (Windows Event ID 4104) capturing exclusion filter logic at runtime
  • > Sysmon EventCode=1 process creation logs with CommandLine containing multiple system file extension references
  • > Prefetch files (.pf in C:\Windows\Prefetch) documenting ransomware execution timestamp and first-accessed file paths
  • > MFT modification timestamps showing mass file modifications with gaps in system directories and binary file formats
  • > Windows Event ID 7045 (new service installed) or 4697 if ransomware establishes service-based persistence before encryption

Tuning Guidance

Begin tuning by building an allowlist of processes and parent processes known to legitimately reference multiple system extensions: backup agents (Veeam.Backup.Agent.exe, CVLT.exe, BackupExecAgent.exe), endpoint security tools, and software deployment systems (CCMExec.exe, PDQDeployRunner.exe). Add exclusions for InitiatingProcessFileName matching these known-good parents. Raise the ExtensionCount threshold from 3 to 5 to reduce noise from simple admin scripts that reference a couple of extensions incidentally. For the SPL query, add NOT clauses for known backup service accounts and IT automation service identities by filtering on the User field. When deploying the file operation hunting query, establish a baseline of normal file modification rates during backup windows (typically 2am-5am) to set appropriate thresholds — backup agents can exceed 1,000 file operations per minute. In high-noise environments, consider combining this detection with T1490 indicators as a compound rule: require both selective exclusion patterns AND shadow copy deletion activity on the same host within 1 hour to auto-escalate, reducing analyst fatigue while maintaining coverage of confirmed ransomware chains.

Hunting Queries

Hunts for high-volume file modification activity that explicitly avoids system file extensions — a direct behavioral signature of ransomware selective exclusion. High file operation rates (>100 operations within 10 minutes) across multiple document extensions with no system binary modifications indicate active encryption in progress.

Hunting — KQL
kql 
// Hunt for mass file modification events that skip system extensions — ransomware selective encryption pattern
DeviceFileEvents
| where TimeGenerated > ago(24h)
| where ActionType in ("FileCreated", "FileModified")
| where FileName !endswith_cs ".dll" and FileName !endswith_cs ".exe" and FileName !endswith_cs ".sys"
    and FileName !endswith_cs ".lnk" and FileName !endswith_cs ".msi" and FileName !endswith_cs ".bat"
| summarize FileOps = count(), UniqueExtensions = dcount(tostring(split(FileName, ".")[-1])), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName
| where FileOps > 100 and UniqueExtensions > 5
| extend DurationSeconds = datetime_diff('second', LastSeen, FirstSeen)
| where DurationSeconds < 600
| extend EncryptionRate = toreal(FileOps) / toreal(DurationSeconds)
| order by EncryptionRate desc
Hunting — SPL
spl 
index=* sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
    NOT (TargetFilename="*.dll" OR TargetFilename="*.exe" OR TargetFilename="*.sys" OR TargetFilename="*.lnk" OR TargetFilename="*.msi" OR TargetFilename="*.bat")
| bucket _time span=5m
| stats count as file_ops, dc(TargetFilename) as unique_files, values(Image) as processes by _time, ComputerName, User
| where file_ops > 100
| eval ops_per_minute=file_ops / 5
| eval severity=if(file_ops > 500, "CRITICAL", if(file_ops > 200, "HIGH", "MEDIUM"))
| table _time, ComputerName, User, processes, file_ops, unique_files, ops_per_minute, severity
| sort - file_ops

Hunts for non-standard executables running from user-writable paths with pipe-separated extension exclusion lists or explicit ransomware CLI flags in their command lines. Focuses on binaries outside standard installation directories to reduce false positives from legitimate administrative tools.

Hunting — KQL
kql 
// Hunt for non-scripting executables with pipe-separated or comma-separated exclusion lists — Embargo/Medusa CLI pattern
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName !in~ ("powershell.exe", "pwsh.exe", "cmd.exe", "wscript.exe", "cscript.exe", "mshta.exe")
| where ProcessCommandLine matches regex @"(?i)(\.(dll|exe|lnk|sys|msi)\|){2,}"
    or ProcessCommandLine matches regex @"(?i)(skip[-_]ext|excl[-_]ext|no[-_]encrypt|ext[-_]whitelist|avoid[-_]ext)"
    or ProcessCommandLine matches regex @"(?i)(-e\s+['\"]?[a-z0-9,|]+\.(dll|exe|sys)[a-z0-9,|'\"]*)"
| where FolderPath !startswith "C:\\Program Files" and FolderPath !startswith "C:\\Windows"
| project TimeGenerated, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, SHA256
| order by TimeGenerated desc
Hunting — SPL
spl 
index=* sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
    NOT (Image="*\\powershell.exe" OR Image="*\\cmd.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe")
    NOT (Image="*\\Program Files\\*" OR Image="*\\Windows\\*")
| regex CommandLine="(?i)(\.(dll|exe|lnk|sys|msi)\|){2,}|(?i)(skip_ext|excl_ext|no_encrypt|ext_whitelist|avoid_ext)"
| table _time, ComputerName, User, Image, CommandLine, ParentImage, Hashes
| sort - _time

Correlates selective exclusion patterns with ransomware preparation activities (shadow copy deletion, backup catalog removal, boot recovery disabling) occurring on the same host within a 30-minute window. This compound detection identifies full ransomware attack chain execution with high confidence, as the combination of both behaviors rarely appears in legitimate administrative workflows.

Hunting — KQL
kql 
// Hunt for selective exclusion co-occurring with ransomware preparation — compound attack chain detection
let RansomwarePrep = DeviceProcessEvents
| where TimeGenerated > ago(24h)
| where FileName in~ ("vssadmin.exe", "bcdedit.exe", "wbadmin.exe", "wmic.exe")
| where ProcessCommandLine has_any ("delete", "shadowstorage", "recoveryenabled", "catalog", "shadowcopy")
| summarize PrepCommands = make_set(ProcessCommandLine), PrepCount = count() by DeviceName, TimeWindow = bin(TimeGenerated, 30m);
DeviceProcessEvents
| where TimeGenerated > ago(24h)
| where ProcessCommandLine matches regex @"(?i)(\.(dll|exe|lnk|sys|msi).+){2,}"
| where ProcessCommandLine matches regex @"(?i)(-notmatch|-notlike|-notcontains|exclu|skip|avoid)"
| summarize ExclusionOps = count() by DeviceName, TimeWindow = bin(TimeGenerated, 30m)
| join kind=inner RansomwarePrep on DeviceName, TimeWindow
| project TimeWindow, DeviceName, ExclusionOps, PrepCount, PrepCommands
| order by TimeWindow desc
Hunting — SPL
spl 
index=* sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
    (Image="*\\vssadmin.exe" OR Image="*\\bcdedit.exe" OR Image="*\\wbadmin.exe")
    (CommandLine="*delete*" OR CommandLine="*shadowstorage*" OR CommandLine="*recoveryenabled*")
| bucket _time span=30m
| stats count as ransom_prep_count, values(CommandLine) as prep_commands by _time, ComputerName
| join type=inner ComputerName [
    search index=* sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
        (CommandLine="*.dll*") (CommandLine="*.exe*") (CommandLine="*.sys*")
        (CommandLine="*notmatch*" OR CommandLine="*exclude*" OR CommandLine="*skip*" OR CommandLine="*avoid*")
    | bucket _time span=30m
    | stats count as excl_ops by _time, ComputerName
]
| where ransom_prep_count > 0 AND excl_ops > 0
| table _time, ComputerName, ransom_prep_count, excl_ops, prep_commands
| sort - _time

Atomic Red Team Tests

Test 1 PowerShell Selective File Exclusion with -notcontains Operator
windows

Simulates ransomware-style selective exclusion logic in PowerShell that explicitly filters out Windows system file extensions (.dll, .exe, .lnk, .sys, .msi) using the -notcontains operator, targeting only document files. Generates the process creation telemetry that triggers detections monitoring for multiple system extension references combined with PowerShell exclusion operators.

Command

powershell 
powershell.exe -ExecutionPolicy Bypass -Command "$exclusions = @('.dll', '.exe', '.lnk', '.sys', '.msi', '.bat', '.cmd', '.ini', '.url', '.drv'); $testDir = Join-Path $env:TEMP 'T1679_test'; New-Item -ItemType Directory -Path $testDir -Force | Out-Null; @('report.docx','budget.xlsx','photo.jpg','notes.txt','system.dll','app.exe','link.lnk','driver.sys','installer.msi') | ForEach-Object { New-Item -Path (Join-Path $testDir $_) -ItemType File -Force | Out-Null }; $targets = Get-ChildItem -Path $testDir | Where-Object { $exclusions -notcontains $_.Extension }; Write-Host '[T1679] Targeting for encryption:'; $targets | ForEach-Object { Write-Host $_.Name }; Write-Host \"[T1679] Excluded system extensions: $($exclusions -join ', ')\""

Cleanup

powershell 
powershell.exe -Command "Remove-Item -Path (Join-Path $env:TEMP 'T1679_test') -Recurse -Force -ErrorAction SilentlyContinue"

Expected Telemetry

Sysmon EventCode=1 with Image ending in powershell.exe, CommandLine containing .dll, .exe, .lnk, .sys, .msi, .bat, .cmd, .ini, .url, .drv extensions and -notcontains operator

Expected Detection

KQL: ExtensionCount >= 10 with ExclusionIndicatorType = PowerShellExclusionOperator. SPL: total_ext_refs >= 10, has_exclusion_keyword = 1, risk_score = HIGH

Test 2 Embargo-Style Regex-Based Extension Exclusion Pattern
windows

Replicates Embargo ransomware's documented technique of using a regular expression within the ransomware binary to identify and skip system-critical file extensions before the encryption routine. The regex pattern matches the structure documented in Cyble's Embargo analysis: a single compiled regex applied to each file path to determine encryption eligibility.

Command

powershell 
powershell.exe -ExecutionPolicy Bypass -Command "$exclusionRegex = '(?i)\.(dll|exe|lnk|sys|msi|bat|cmd|ini|url|drv|ocx|pif|com)$'; $testFiles = @('document.docx', 'spreadsheet.xlsx', 'presentation.pptx', 'image.jpg', 'backup.bak', 'system.dll', 'application.exe', 'shortcut.lnk', 'driver.sys', 'installer.msi', 'script.bat', 'config.ini'); $encryptTargets = $testFiles | Where-Object { $_ -notmatch $exclusionRegex }; $excludedFiles = $testFiles | Where-Object { $_ -match $exclusionRegex }; Write-Host \"[T1679-Embargo] Exclusion regex: $exclusionRegex\"; Write-Host \"[T1679-Embargo] Encrypt targets ($($encryptTargets.Count)): $($encryptTargets -join ', ')\"; Write-Host \"[T1679-Embargo] Excluded ($($excludedFiles.Count)): $($excludedFiles -join ', ')\""

Cleanup

powershell 
echo No cleanup required - no files written

Expected Telemetry

Sysmon EventCode=1 with Image=powershell.exe, CommandLine containing regex pattern referencing dll|exe|lnk|sys|msi|bat|cmd|ini|url|drv|ocx|pif|com and -notmatch operator

Expected Detection

KQL: ExtensionCount >= 12 with ExclusionIndicatorType = PowerShellExclusionOperator. SPL: total_ext_refs >= 12, has_exclusion_keyword = 1, risk_score = HIGH

Test 3 CMD Batch Script Selective File Targeting with Multiple IF NOT Conditions
windows

Simulates a CMD batch script-based ransomware loader that performs selective file targeting using chained IF NOT conditions to skip Windows system file extensions. This pattern represents script-based ransomware or dropper scripts that iterate files while avoiding system binaries to prevent immediate detection.

Command

powershell 
cmd.exe /c "(echo @echo off & echo setlocal & echo for %%%%f in (%TEMP%\*.*) do ( & echo   if /I not ""%%%%~xf""=="".dll"" if /I not ""%%%%~xf""=="".exe"" if /I not ""%%%%~xf""=="".sys"" if /I not ""%%%%~xf""=="".lnk"" if /I not ""%%%%~xf""=="".msi"" if /I not ""%%%%~xf""=="".bat"" echo [T1679] Targeting: %%%%f & echo ) ) > %TEMP%\T1679_batch_test.bat & call %TEMP%\T1679_batch_test.bat"

Cleanup

powershell 
cmd.exe /c "del /F /Q %TEMP%\T1679_batch_test.bat 2>nul"

Expected Telemetry

Sysmon EventCode=1 with Image=cmd.exe, CommandLine containing .dll, .exe, .sys, .lnk, .msi, .bat in multiple IF NOT conditional statements

Expected Detection

KQL: ExtensionCount >= 6 with ExclusionIndicatorType = MultipleSystemExtensions. SPL: total_ext_refs >= 6, risk_score = MEDIUM

Test 4 InvisibleFerret-Style Path and Extension Avoidance Enumeration
windows

Simulates InvisibleFerret malware's documented capability to scan for file names and extensions while avoiding pre-designated path names and file types. Combines path-based and extension-based exclusion to replicate the dual-filter approach observed in this North Korean threat actor tooling.

Command

powershell 
powershell.exe -ExecutionPolicy Bypass -Command "$avoidExtensions = @('.dll', '.exe', '.sys', '.lnk', '.msi', '.bat', '.cmd', '.ini', '.url', '.drv', '.ocx', '.pif'); $avoidPaths = @('Windows', 'System32', 'SysWOW64', 'Program Files', 'ProgramData', 'AppData'); $scanRoot = $env:USERPROFILE; $results = @(); Get-ChildItem -Path $scanRoot -Recurse -File -ErrorAction SilentlyContinue -Depth 3 | Where-Object { ($avoidExtensions -notcontains $_.Extension) -and (-not ($avoidPaths | Where-Object { $_.FullName -like \"*$_*\" })) } | Select-Object -First 10 | ForEach-Object { $results += $_.FullName; Write-Host \"[T1679-InvisibleFerret] Scan candidate: $($_.FullName)\" }; Write-Host \"[T1679-InvisibleFerret] Candidates: $($results.Count) | Avoided ext: $($avoidExtensions.Count) | Avoided paths: $($avoidPaths.Count)\""

Cleanup

powershell 
echo No cleanup required - read-only file enumeration

Expected Telemetry

Sysmon EventCode=1 with Image=powershell.exe, CommandLine containing avoidExtensions array with 12 system extensions, avoidPaths array, -notcontains and -like operators, Get-ChildItem cmdlet

Expected Detection

KQL: ExtensionCount >= 12 with ExclusionIndicatorType = PowerShellExclusionOperator. SPL: total_ext_refs >= 12, has_exclusion_keyword = 1, risk_score = HIGH. May also trigger file enumeration hunting queries based on subsequent Get-ChildItem activity.

Related Detections

Tactic Hub

TA0005Defense Evasion

Related Techniques

T1486Data Encrypted for ImpactT1490Inhibit System RecoveryT1083File and Directory DiscoveryT1027Obfuscated Files or InformationT1222File and Directory Permissions Modification

Same Tactic: Defense Evasion

Popular Detections