Windows Defender Exclusion of C Drive

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects attempts to exclude the entire C:\ drive from Microsoft Defender Antivirus scanning. Adversaries may attempt to exclude the entire C:\ drive from Microsoft Defender Antivirus scanning to avoid detection of their malicious activities. The entire C:\ drive, including all its subdirectories (C:\Windows\, C:\Program Files\, C:\Users\, etc.), will not be scanned. This can be used to hide malware from being detected by Microsoft Defender Antivirus.

2025-03-13 00:00:00

None

87db517c-3ad2-45e4-9e9b-692360da389d

attack.defense-evasion attack.t1562.001

Nextron Sigma feed only (private)