tfMITRE ATT&CK technique

Selective Exclusion T1679

Tactic: Stealth
Platform: Windows
Version: 2.0
Created: 25 September 2025
Last modified: 12 May 2026

Adversaries may intentionally exclude certain files, folders, directories, file types, or system components from encryption or tampering during a ransomware or malicious payload execution. Some file extensions that adversaries may avoid encrypting include .dll, .exe, and .lnk.[1]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware68th pct

Tools & malware68th percentile · 68% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Selective Exclusion MITRE reference T1679

45th pctamong all ATT&CK techniques for number of groups

1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

VOID MANTICOREG1055 ↗

Has avoided interacting with specific directories in order to reduce the likelihood of detection.1

created 2026-04-201 referenceaka COBALT MYSTIQUE

All 1 groups for this technique

Offense vs defense T1679

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Selective Exclusion detection strategy DET0897

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection of Selective Exclusion

Enterprise

1 platform

AN2030 · Windows

A process with no prior history or outside of known whitelisted tools initiates file or registry modifications to configure exclusion rules for antivirus, backup, or file-handling systems. Or a file system enumeration for specific file names andcritical extensions like .dll, .exe, .sys, or specific directories such as 'Program Files' or security tool paths or system component discovery for the exclusion of the files or components.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Security	EventCode=4688
File ModificationDC0061	WinEventLog:Security	EventCode=4663, 4670, 4656
Command ExecutionDC0064	WinEventLog:PowerShell	EventCode=4103, 4104, 4105, 4106

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Correlate multiply discovery activities and file enumeration activities.
DiscoveryActivityThreshold	Minimum number of different discovery techniques within time window to trigger detection - balance between false positives and coverage (default: 4 activities)
ExclusionTargetList	List of extensions or folders considered suspicious when excluded (e.g., .dll, .exe, C:\\Program Files\\)
AuthorizedExclusionModifiers	Whitelist of known system management tools/processes allowed to modify exclusion settings

Selective Exclusion detections T1679

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs