Adversaries may intentionally exclude certain files, folders, directories, file types, or system components from encryption or tampering during a ransomware or malicious payload execution. Some file extensions that adversaries may avoid encrypting include `.dll`, `.exe`, and `.lnk`. Adversaries…

T1679 Selective Exclusion

title: T1679 Selective Exclusion
id: d20ad515-d890-489e-807a-8507d02c170a
description: 'The selective-exclusion decision itself (a ransomware binary''s internal choice not to encrypt certain extensions such as .dll/.exe/.lnk) produces no direct Windows/Sysmon event and cannot be observed via telemetry; the previous version instead matched Windows Defender exclusion tampering (Add-MpPreference -ExclusionPath), which is Impair Defenses (T1562.001), not Selective Exclusion. As the closest defensible Windows-observable proxy, this rule flags ransom-note file drops, an artifact commonly produced immediately after selective, extension-aware encryption completes. Tune using: TimeWindow, DiscoveryActivityThreshold, ExclusionTargetList, AuthorizedExclusionModifiers.'
references:
  - https://attack.mitre.org/techniques/T1679
author: Shahrukh Khan
date: 2026-06-02
license: MIT
tags:
  - attack.stealth
  - attack.t1679

logsource:
  category: file_event
  product: windows
  service: sysmon

detection:
  selection:
    TargetFilename|contains:
      - 'README'
      - 'DECRYPT'
      - 'HOW_TO_DECRYPT'
      - 'RECOVER'
    TargetFilename|endswith:
      - '.txt'
      - '.html'
      - '.hta'

  condition: selection

falsepositives:
  - Legitimate software occasionally ships README/RECOVER text files with matching names; this is a low-confidence proxy given this sub-technique's behavior has no direct telemetry signature - recommend SME validation and correlation with mass file-write activity.

level: medium

T1679 — Selective Exclusion

Sigma detection rules (1)

T1679 Selective Exclusion

Explore