T1564.012 — File/Path Exclusions

Tactic: Stealth · Platforms: Linux, macOS, Windows

Adversaries may attempt to hide their file-based artifacts by writing them to specific folders or file names excluded from antivirus (AV) scanning and other defensive capabilities. AV and other file-based scanners often include exclusions to optimize performance as well as ease installation and…

Sub-technique of Hide Artifacts (T1564).

Sigma detection rules (3)

T1564.012 Hide Artifacts: File/Path Exclusions

title: "T1564.012 Hide Artifacts: File/Path Exclusions"
id: f9394940-f7d3-429b-bfdc-83bae2b1deaf
description: 'Detection Strategy for File/Path Exclusions - file creation within default AV/EDR self-exclusion directories commonly abused to evade scanning. (Data Component: File Creation; baseline tier: windows-eventid.) Tune using: ExcludedPaths, ProcessAllowlist.'
references:
  - https://attack.mitre.org/techniques/T1564/012
author: Shahrukh Khan
date: 2026-01-01
license: MIT
tags:
  - attack.stealth
  - attack.t1564.012

logsource:
  category: file_event
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '11'
    TargetFilename|contains:
      - '\ProgramData\Microsoft\Windows Defender\'
      - '\Program Files\Windows Defender\'
      - '\Program Files\Windows Defender Advanced Threat Protection\'
      - '\Program Files\CrowdStrike\'
      - '\Program Files\Trend Micro\'
      - '\Program Files\Symantec\'
      - '\Program Files\McAfee\'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not filter_system_account

falsepositives:
  - System and service accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) performing the same action are excluded via filter_system_account; tune further with process/path allowlists if noise remains.

level: medium

T1564.012 Hide Artifacts: File/Path Exclusions

title: "T1564.012 Hide Artifacts: File/Path Exclusions"
id: 4761e1b1-5919-47aa-8643-8bfcb27e6d17
description: 'Detects file creation events occurring inside directories that are commonly hardcoded as default AV/EDR scan exclusions on Linux (container/orchestration runtime paths, snap mounts), which adversaries abuse to stage payloads without needing to modify any exclusion configuration. Auditd cannot read an AV products actual configured exclusion list content, so this is a proxy based on well-known default-excluded directories rather than the site-specific list; tune ExcludedDirectories to the hosts actual AV/EDR exclusion configuration for higher precision.'
references:
  - https://attack.mitre.org/techniques/T1564/012
author: Shahrukh Khan
date: 2026-06-06
license: MIT
tags:
  - attack.stealth
  - attack.t1564.012

logsource:
  category: file_event
  product: linux
  service: auditd

detection:
  selection:
    type: PATH
    nametype: CREATE
    name|contains:
      - '/var/lib/docker/'
      - '/var/lib/containerd/'
      - '/var/lib/kubelet/'
      - '/var/lib/lxc/'
      - '/snap/'
  condition: selection

falsepositives:
  - Container orchestration and packaging systems (Docker, containerd, Kubernetes, LXC, snapd) legitimately write large numbers of files into these paths as part of normal operation; without the sites actual configured exclusion list this is a high-volume, low-precision proxy.

level: medium

T1564.012 Hide Artifacts: File/Path Exclusions

title: "T1564.012 Hide Artifacts: File/Path Exclusions"
id: 6386792e-51eb-446e-9e14-4e63b4d695fc
description: 'Detection Strategy for File/Path Exclusions. (Retargeted to the file_event macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: AVExclusionPaths, ProcessContext.'
references:
  - https://attack.mitre.org/techniques/T1564/012
author: Shahrukh Khan
date: 2026-02-02
license: MIT
tags:
  - attack.stealth
  - attack.t1564.012

logsource:
  category: file_event
  product: macos

detection:
  selection:
    Image|endswith: '/defaults'
    CommandLine|contains|all:
      - 'com.apple.xprotect'
      - 'exclu'

  condition: selection

falsepositives:
  - Endpoint security vendors legitimately registering their own installation directories as scan exclusions during agent deployment.

level: high

Related sub-techniques

Explore