Disable or Modify Tools × Microsoft Defender

attackers first added exclusions to Microsoft Defender to evade detection

After initial access, Turla adds registry-based exclusions to Microsoft Defender for the implant's directory (e.g., C:\Windows\System32). The TTNG DLL is written to disk and persisted as a Windows service masquerading as 'System Device Manager', executed via svchost.exe. Chisel is deployed to create encrypted tunnels for pivoting and data exfiltration.

Monitor for registry modifications to Windows Defender exclusion paths (e.g., HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths). Detect creation of suspicious services with names like 'sdm' loading DLLs from system32. Use endpoint detection to flag svchost.exe loading unsigned DLLs.