MITRE ATT&CK T1679 Selective Exclusion Guide

MITRE ATT&CK T1679 Selective Exclusion describes ransomware and wipers that deliberately leave certain files, folders or systems untouched so the machine keeps running, the attack stays quiet for longer and the ransom note can still be read. Medusa skips files such as .dll, .exe and .lnk, DynoWiper avoids System32 and Program Files, LazyWiper checks whether a host is a domain controller before wiping, and The Gentlemen ransomware is recorded adding a security product exclusion for the whole C: volume. ATT&CK v20 places T1679 under the Stealth tactic for Windows. The behaviour is useful to defenders: an exclusion list tells you where encryption will not happen, which shapes where decoy files belong, which telemetry matters and what recovery can and cannot trust. This guide covers detection, prevention and recovery implications for detection engineers, endpoint teams and incident responders.

Key takeaways

Two kinds of exclusion. Malware's own skip lists (extensions, folders, hostnames) and exclusions the attacker adds to your security tools are both covered by T1679, and they need different controls.
Security tool exclusions are the detectable half. A new antivirus or EDR exclusion for a broad path, added by an unusual process, is a high-value alert; Microsoft Defender logs configuration changes as Event ID 5007.
Lock exclusions down. Tamper protection, central management of exclusion lists and blocking local merges stop most attacker-added exclusions before they matter.
Put decoys where encryption will go. Since ransomware skips .exe, .dll and system folders, canary files belong among user documents and file shares, not in Program Files.
A working OS is not a clean OS. Systems left bootable on purpose still need rebuilding from known-good images; untouched system folders say nothing about persistence.

What T1679 describes

MITRE defines Selective Exclusion as adversaries intentionally excluding "certain files, folders, directories, file types, or system components from encryption or tampering" during ransomware or other malicious payload execution. The stated reasons are to avoid alerting users, to evade security tools and analysts, and, for ransomware, to keep the system working well enough to deliver the ransom notice. Targets are files and components whose corruption would cause instability, break core services or immediately expose the attack.

Exclusion type	Example recorded by MITRE or the cited analysis	Why it matters to defenders
File extensions	ATT&CK lists .dll, .exe and .lnk as extensions ransomware may avoid, citing Medusa	Decoy files must use document and data extensions to be touched
Folders	DynoWiper skips System32, Windows, Program Files, Temp, Recycle Bin, Boot, PerfLogs and AppData, among others	Encryption concentrates on user profiles, data drives and shares
Named files	SameCoin avoids overwriting desktop.ini and conf.conf	Small skip lists keep Explorer and some apps behaving normally
Pattern rules	Embargo uses a regular expression in the binary to decide what to skip	Skip logic is configurable and changes between builds
Whole systems	LazyWiper checks the hostname to decide whether a host is a domain controller and excludes it from wiping	Attackers may preserve infrastructure they still need
Security tool exclusions	The Gentlemen ransomware added a Microsoft Defender exclusion path for C:\ with `Add-MpPreference`, per Microsoft threat intelligence cited by MITRE	Directly detectable and preventable on the endpoint

MITRE also records VOID MANTICORE avoiding specific directories to reduce the chance of detection, and InvisibleFerret skipping predefined path names and file types. See the Medusa Ransomware Threat Actor Profile, The Gentlemen Ransomware Profile Guide and Handala and Void Manticore Threat Actor Profile Guide for the actors.

Detection analytics

MITRE's detection strategy for T1679 (DET0897 in ATT&CK v20) has one Windows analytic. It looks for a process with no prior history, or outside known management tools, modifying files or registry to set exclusion rules for antivirus, backup or file-handling systems; and for file system enumeration or system discovery aimed at critical extensions, Program Files or security tool paths. It names these log sources and tuning inputs:

Log source	Event IDs	What to extract
PowerShell	4103, 4104, 4105, 4106	Exclusion cmdlets and parameters, such as `Add-MpPreference` or `Set-MpPreference` with exclusion path, extension or process arguments
Security: process creation	4688	Parent, command line and account of processes changing security settings or running discovery
Security: object access	4656, 4663, 4670	Access to and permission changes on exclusion-related registry keys and security tool paths (needs SACLs)
Tuning inputs MITRE lists	All of the above	Time window; discovery activity threshold (default four activities); list of suspicious exclusion targets such as .dll, .exe or C:\Program Files\; allowlist of authorised exclusion modifiers

Microsoft Defender Antivirus adds its own events: Event ID 5007 records a platform configuration change with old and new values, and Microsoft advises reviewing an unexpected one because it may be the result of malware; Event ID 5013 records that tamper protection blocked a change and names the setting; Event ID 5001 records real-time protection being disabled. Other endpoint products log equivalent configuration and policy changes; check your vendor's documentation for the event names.

High-value rules

Broad exclusion added: a new exclusion for a drive root, a user profile root, a file share, or extensions such as .exe or .dll. These are rarely legitimate.
Exclusion from an unusual source: exclusions set locally by PowerShell, WMI or direct registry writes on devices where exclusions are normally pushed by Intune, Configuration Manager or Group Policy.
Exclusion followed by mass file changes: any exclusion change followed within hours by high-rate file renames or writes on the same host or share.
Tamper protection blocks: Event ID 5013 on any device is a strong sign someone tried to change protection, whether or not it worked.
Selective enumeration: one process walking user data and shares at high speed while skipping system folders, visible in EDR file telemetry and in object access auditing on file servers.
Domain controller checks before destructive activity: hostname or role discovery immediately before wiping or encryption activity elsewhere, the pattern LazyWiper shows.

Governance of legitimate exclusions is covered in the EDR Tuning and Exclusions Management Guide; this page focuses on attacker use.

Prevention controls

Control	What to configure	Effect on T1679
Tamper protection	Turn on Microsoft Defender tamper protection (or your endpoint product's equivalent); Microsoft documents that, when enabled, exclusions cannot be modified or added locally and registry changes to Defender settings are blocked	Blocks attacker-added exclusions
Tamper-protected exclusions	Meet Microsoft's conditions: Defender platform 4.18.2211.5 or later, `DisableLocalAdminMerge` enabled, devices managed only by Intune or only by Configuration Manager with the Defender for Endpoint sensor, and exclusions managed centrally. Verify with the `TPExclusions` registry value under the Defender Features key (1 means protected)	Protects the organisation's own exclusion list from change
Block local merge	`DisableLocalAdminMerge` so local exclusions are not merged with policy	Local admin cannot quietly add exclusions
Controlled folder access	Microsoft Defender controlled folder access, off by default; run Audit Mode first, then Enabled; add data folders and shares to the protected list	Untrusted processes cannot change files in the folders ransomware targets
Least privilege	Remove standing local admin; separate admin accounts	Most exclusion changes need admin rights
Immutable, off-host backups	Backups the compromised host and its credentials cannot alter	Recovery does not depend on what the malware skipped

Decoys and canaries that match exclusion logic

Ransomware skip lists are a design input for deception. D3FEND lists Decoy File (D3-DF) as a deceptive technique, and exclusion lists tell you where it pays off.

Use targeted extensions: .docx, .xlsx, .pdf, .jpg, database and archive files, never .exe or .dll.
Use targeted locations: user Documents and Desktop folders, departmental shares and the top of large data shares, where enumeration starts.
Avoid excluded paths: canaries in Program Files, Windows or AppData may never be touched by families such as Medusa or DynoWiper.
Alert on any write or rename: a single change to a canary is enough to trigger host isolation in a mature playbook.
Keep them believable and documented: name them like real data, record them so administrators and backup jobs do not trip them, and exclude them from user-facing search where possible.

Recovery implications

Selective exclusion leaves systems bootable, which can tempt teams to decrypt or restore data in place. Rebuild from known-good images instead: untouched executables and system folders are exactly where an attacker would leave tools and persistence, and the exclusion list says nothing about what else was changed. Check security tool configuration on every restored host, because added exclusions survive data restores. If domain controllers were deliberately spared, treat them as attacker infrastructure until proven otherwise. See the MITRE ATT&CK T1486 Data Encrypted for Impact guide for the encryption stage and the Wiper Malware Guide for destructive variants.

Where identity fits

Adding a security tool exclusion needs administrative rights on the host or control of the management plane. That makes it an identity problem: watch for exclusion policy changes in Intune, Configuration Manager or Group Policy made by accounts that do not normally make them, protect those admin roles with phishing-resistant MFA and privileged access workstations, and keep service accounts used by deployment tooling out of interactive use. A spared domain controller is also a sign the attacker values its identity data, so include directory recovery in the plan.

How to implement

Inventory current exclusions. Export exclusions from every endpoint management source and on-device setting; remove broad and unexplained entries.
Turn on tamper protection across the estate and meet the conditions for tamper-protected exclusions where you use Microsoft Defender.
Collect the events. Forward Defender 5001, 5007 and 5013 (or vendor equivalents), PowerShell 4104 and process creation, and enable object access auditing on exclusion-related keys for high-value servers.
Deploy detections in stages. Start with broad-exclusion and local-source rules, review for two weeks, then add correlation with mass file changes.
Pilot controlled folder access in Audit Mode, review blocked applications, add trusted ones, then switch to Enabled for pilot groups.
Place canaries on file servers and a sample of endpoints and wire alerts to isolation.
Test in an authorised lab with a benign script that tries to add an exclusion and rename canary files, and confirm blocks and alerts.
Roll back controlled folder access to Audit Mode if business applications break, rather than turning it off.

Decision guidance

Central or local exclusions: manage exclusions only centrally, and block local merge, wherever device management allows it.
Controlled folder access scope: start with users who handle sensitive documents and with shared workstations; expand once the trusted app list is stable.
Small organisations: turn on tamper protection, remove local admin, keep immutable backups and alert on Event ID 5007.
Large organisations: add canaries, mass-change correlation and management-plane monitoring for exclusion policy changes.

Detection and measurement

Tamper protection coverage: percentage of endpoints with tamper protection on, and with tamper-protected exclusions where applicable.
Exclusion hygiene: number of broad exclusions (drive roots, profile roots, executable extensions) across the estate, trending to zero.
Configuration change alerts: unexpected exclusion changes per month and median time to review each.
Canary coverage: share of file servers and data shares with canary files and tested alerting.
Test result: share of authorised exclusion-tamper tests blocked or detected.

Framework mapping

Framework	Item	Relevance
MITRE ATT&CK	T1679 Selective Exclusion; related T1685 Disable or Modify Tools, T1486 Data Encrypted for Impact, T1083 File and Directory Discovery	The technique and the steps around it
MITRE D3FEND	D3-DF Decoy File; D3-FCA File Creation Analysis; D3-LFP Local File Permissions	Canaries, file activity analysis, protecting folders
NIST SP 800-53 Rev. 5	SI-3 Malicious Code Protection; SI-4 System Monitoring; CM-5 Access Restrictions for Change; CP-9 System Backup	Protected anti-malware, monitoring, change restriction, backup
NIST CSF 2.0	PR.PS-01; DE.CM-09; PR.DS-11	Configuration management, runtime monitoring, protected backups

Common failure patterns

Canaries in the wrong place: decoy files placed in system or program folders that ransomware is built to skip.
Exclusions nobody reviews: years of accumulated broad exclusions that give an attacker an existing blind spot without changing anything.
Tamper protection partly deployed: on by default for some devices, off on servers or co-managed devices where it matters most.
Restoring onto spared systems: trusting bootable hosts because system files were untouched, and missing added exclusions and persistence.
Ignoring blocked attempts: treating Event ID 5013 as a success story instead of evidence of an active intruder.

Practitioner checklist

Export and review every antivirus and EDR exclusion; remove broad entries.
Turn on tamper protection everywhere and verify tamper-protected exclusions where supported.
Block local exclusion merge with DisableLocalAdminMerge or the vendor equivalent.
Alert on Defender Event IDs 5001, 5007 and 5013 and on exclusion cmdlets in PowerShell logs.
Correlate exclusion changes with mass file renames on the same host or share.
Place canary files with document extensions in user folders and data shares.
Enable controlled folder access in Audit Mode, then Enabled, for priority groups.
Rebuild affected hosts from known-good images and recheck security tool settings after restore.

MITRE ATT&CK T1679 Selective Exclusion: Detecting Evasion