tfMITRE ATT&CK sub-technique

File/Path Exclusions T1564.012

Tactic: Stealth
Platforms: Linux, macOS, Windows
Version: 2.0
Created: 29 March 2024
Last modified: 12 May 2026

Adversaries may attempt to hide their file-based artifacts by writing them to specific folders or file names excluded from antivirus (AV) scanning and other defensive capabilities. AV and other file-based scanners often include exclusions to optimize performance as well as ease installation and legitimate use of applications. These exclusions may be contextual (e.g., scans are only initiated in response to specific triggering events/alerts), but are also often hardcoded strings referencing specific folders and/or files assumed to be trusted and legitimate.[1]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

File/Path Exclusions MITRE reference T1564.012

45th pctamong all ATT&CK techniques for number of groups

1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

TurlaG0010 ↗

Has placed LunarWeb install files into directories that are excluded from scanning.1

created 2017-05-311 referenceaka IRON HUNTER

All 1 groups for this technique

Offense vs defense T1564.012

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

File/Path Exclusions detection strategy DET0051

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for File/Path Exclusions

Enterprise

3 platforms

AN0139 · Windows

Creation or modification of files in directories known to be excluded from AV scanning (e.g., C:\Windows\Temp, Exchange server directories, or default AV exclusions). Defender perspective: correlate file creation with execution behavior or anomalous parent processes writing to excluded paths.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File CreationDC0039	WinEventLog:Sysmon	EventCode=11
File AccessDC0055	WinEventLog:Security	EventCode=4663, 4670, 4656

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ExcludedPaths	List of directories excluded from scanning in the environment (customizable per organization).
ProcessAllowlist	Legitimate processes typically writing to excluded paths to minimize false positives.

AN0140 · Linux

Adversaries writing or moving payloads into directories configured as AV/EDR exclusion paths (e.g., /tmp, /var/lib, or custom directories from auditd exclusion rules). Defender perspective: detect file creation in paths matching known exclusions correlated with unusual parent processes.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File CreationDC0039	auditd:SYSCALL	open or creat syscalls targeting excluded paths
File MetadataDC0059	auditd:PATH	file path matches exclusion directories

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ExcludedDirectories	System- or security-tool-configured exclusion directories where files should rarely change.
CorrelationWindow	Time window to correlate file creation in excluded paths with execution or network activity.

AN0141 · macOS

Suspicious file creation or modification in directories ignored by XProtect or AV exclusions (e.g., ~/Library, temporary cache directories). Defender perspective: monitor file events in ignored paths with correlation to execution or persistence activity.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	process writes or modifies files in excluded paths
File CreationDC0039	macos:unifiedlog	file creation in AV exclusion directories

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AVExclusionPaths	Paths ignored by AV/XProtect that should be monitored for abnormal writes.
ProcessContext	Expected user or application context writing to excluded directories.

Tests1ExecutorsPowerShell 1Need elevation0 of 1Have prerequisites1Have cleanup1Platformswindows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Stage and execute a payload from a Windows Defender excluded path

windows

PowerShell

—

Yes

Writes an executable payload into a directory that is excluded from Microsoft Defender scanning and executes it from that location. Rather than modifying tool settings to create a new exclusion, adversaries may place file-based payloads in existing default or otherwise well-known exclusions so that the artifact is never scanned. A copy of a benign signed binary (calc.exe) is used as the payload so that no malicious content is written to disk. Upon successful execution, the payload is copied into the excluded directory and launched from there.

Input arguments

Name	Type	Default	Description
payload_name	string	art-staged-payload.exe	File name given to the staged payload inside the excluded directory.
excluded_path	path	C:\Temp\ARTExclusionTest	Directory that is present in the Defender exclusion list, used to stage the payload.
payload_source	path	C:\Windows\System32\calc.exe	Benign binary copied into the excluded directory to act as the staged payload.

Attack command

Copy-Item "#{payload_source}" -Destination "#{excluded_path}\#{payload_name}" -Force
Start-Process "#{excluded_path}\#{payload_name}"

Cleanup command

$payloadProcess = [System.IO.Path]::GetFileNameWithoutExtension("#{payload_name}")
Stop-Process -Name $payloadProcess -Force -ErrorAction SilentlyContinue
Remove-Item "#{excluded_path}\#{payload_name}" -Force -ErrorAction SilentlyContinue
$markerPath = Join-Path "#{excluded_path}" ".art-created-defender-exclusion"
if (Test-Path $markerPath) {
  Remove-Item $markerPath -Force -ErrorAction SilentlyContinue
  Remove-MpPreference -ExclusionPath "#{excluded_path}" -ErrorAction SilentlyContinue
  Remove-Item "#{excluded_path}" -Force -ErrorAction SilentlyContinue
}

Prerequisite

An excluded directory (#{excluded_path}) must exist and be present in the Defender exclusion list. Adding a Defender exclusion requires administrative privileges and fails when Tamper Protection is enabled.

Check

if ((Get-MpPreference).ExclusionPath -contains "#{excluded_path}") {exit 0} else {exit 1}

Satisfy

$markerPath = Join-Path "#{excluded_path}" ".art-created-defender-exclusion"
New-Item -ItemType Directory "#{excluded_path}" -Force | Out-Null
Add-MpPreference -ExclusionPath "#{excluded_path}" -ErrorAction Stop
New-Item -ItemType File $markerPath -Force | Out-Null

Prerequisite

The payload source (#{payload_source}) must exist on disk.

Check

if (Test-Path "#{payload_source}") {exit 0} else {exit 1}

Satisfy

Write-Host "The payload source must already exist at #{payload_source}."

GUID840d968e-b428-4b94-94ca-cbe34496b27f

Tests from Atomic Red Team (MIT licence) · technique definition

File/Path Exclusions detections T1564.012

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs