tfMITRE ATT&CK technique

Selective Exclusion T1679

Tactic: Stealth
Platform: Windows
Version: 2.0
Created: 25 September 2025
Last modified: 12 May 2026

Adversaries may intentionally exclude certain files, folders, directories, file types, or system components from encryption or tampering during a ransomware or malicious payload execution. Some file extensions that adversaries may avoid encrypting include .dll, .exe, and .lnk.[1]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware68th pct

Tools & malware68th percentile · 66% of ATT&CK techniques have fewer tools implementing them.

Detection rulesNone recorded

Detection rulesNone recorded · 32% of ATT&CK techniques have none either.

Offense vs defense T1679

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Security	EventCode=4688
File ModificationDC0061	WinEventLog:Security	EventCode=4663, 4670, 4656
Command ExecutionDC0064	WinEventLog:PowerShell	EventCode=4103, 4104, 4105, 4106

Data component

Name

Channel

Process CreationDC0032

WinEventLog:Security

EventCode=4688

File ModificationDC0061

WinEventLog:Security

EventCode=4663, 4670, 4656

Command ExecutionDC0064

WinEventLog:PowerShell

EventCode=4103, 4104, 4105, 4106

Field	What you tune
TimeWindow	Correlate multiply discovery activities and file enumeration activities.
DiscoveryActivityThreshold	Minimum number of different discovery techniques within time window to trigger detection - balance between false positives and coverage (default: 4 activities)
ExclusionTargetList	List of extensions or folders considered suspicious when excluded (e.g., .dll, .exe, C:\\Program Files\\)
AuthorizedExclusionModifiers	Whitelist of known system management tools/processes allowed to modify exclusion settings

Field

What you tune

TimeWindow

Correlate multiply discovery activities and file enumeration activities.

DiscoveryActivityThreshold

Minimum number of different discovery techniques within time window to trigger detection - balance between false positives and coverage (default: 4 activities)

ExclusionTargetList

List of extensions or folders considered suspicious when excluded (e.g., .dll, .exe, C:\\Program Files\\)

AuthorizedExclusionModifiers

Whitelist of known system management tools/processes allowed to modify exclusion settings

Offense vs defense T1679

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Security	EventCode=4688
File ModificationDC0061	WinEventLog:Security	EventCode=4663, 4670, 4656
Command ExecutionDC0064	WinEventLog:PowerShell	EventCode=4103, 4104, 4105, 4106

Data component

Name

Channel

Process CreationDC0032

WinEventLog:Security

EventCode=4688

File ModificationDC0061

WinEventLog:Security

EventCode=4663, 4670, 4656

Command ExecutionDC0064

WinEventLog:PowerShell

EventCode=4103, 4104, 4105, 4106

Field	What you tune
TimeWindow	Correlate multiply discovery activities and file enumeration activities.
DiscoveryActivityThreshold	Minimum number of different discovery techniques within time window to trigger detection - balance between false positives and coverage (default: 4 activities)
ExclusionTargetList	List of extensions or folders considered suspicious when excluded (e.g., .dll, .exe, C:\\Program Files\\)
AuthorizedExclusionModifiers	Whitelist of known system management tools/processes allowed to modify exclusion settings

Field

What you tune

TimeWindow

Correlate multiply discovery activities and file enumeration activities.

DiscoveryActivityThreshold

Minimum number of different discovery techniques within time window to trigger detection - balance between false positives and coverage (default: 4 activities)

ExclusionTargetList

List of extensions or folders considered suspicious when excluded (e.g., .dll, .exe, C:\\Program Files\\)

AuthorizedExclusionModifiers

Whitelist of known system management tools/processes allowed to modify exclusion settings

Select	Title	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
No rules found. Try adjusting your filters.

Title

Description

Selective Exclusion T1679

Selective Exclusion T1679

Selective Exclusion MITRE reference T1679

Offense vs defense T1679

Selective Exclusion detection strategy DET0897

Detection of Selective Exclusion

Log sources

Tunable fields

Selective Exclusion MITRE reference T1679

Offense vs defense T1679

Selective Exclusion detection strategy DET0897

Detection of Selective Exclusion

Log sources

Tunable fields

Selective Exclusion detections T1679

Selective Exclusion detections T1679