A new sample of the GootKit malware family evaded detection from Windows Defender by setting a path exclusion.

According to Bleeping Computer, malware researcher and reverse engineer Vitali Kremez analyzed a new sample of GootKit malware and found that it came with a way to bypass Windows Defender.

The bypass began when the malware sample ran some code to determine whether Windows Defender was running on the infected machine. If it was, GootKit executed a command to create a registry value as part of a User Account Control (UAC) bypass. It then progressed through a sequence of commands in which it whitelisted the malware executable path, thereby effectively shielding the sample from Windows Defender.

Bleeping Computer noted that this bypass would work even if Microsoft began detecting this particular GootKit sample in the future, noting that the malware’s path would still be hidden from Windows Defender in future attacks.

Malware Evasion Techniques Are Trending

The GootKit sample detected by Kremez isn’t the only threat to use evasion-based tactics in recent months. In July, Bleeping Computer reported on a sample of the TrickBot banking Trojan family that arrived with 12 new modules designed to disable Windows Defender and Microsoft Defender APT. About a month later, FortiGuard Labs observed a new Ursnif sample hiding its API functions and encrypting most data in its main module. Then, in early September, Cofense detected a phishing campaign that used SharePoint to evade email perimeter technologies in its effort to prey on banks.

How to Defend Against GootKit Malware

Security professionals can help defend their organizations against GootKit malware by using a unified endpoint management (UEM) solution to monitor all devices for suspicious activity and take any necessary precautions. Companies should also consider investing in artificial intelligence (AI)-based technology to defend against attacks that use evasion and other tactics to bypass traditional security solutions.