Exclusion Auditor — open-source, read-only tool to find risky NGAV…

Built this to solve an ops problem I kept hitting: people rarely audit NGAV exclusions,

and they pile up into ungoverned blind spots (T1562.001). It's a free, read-only

CLI that scores your exclusions for security risk and hygiene.

- Rules for executable-extension / root & writable-path / LOLBin-interpreter /

wildcard / scope / hygiene, each mapped to ATT&CK with a remediation.

- CrowdStrike Falcon adapter (ML / IOA / Sensor Visibility, read-only) + an

import mode (JSON/CSV) so any vendor — or no API access — works.

- Read-only by design, no telemetry, credentials from env only.

- Sanitized-output mode so you can share findings/false-positives without

leaking paths, identities, host groups, or tenant data.

Validated against a real production Falcon tenant. It's v0.1 and I'm actively

tuning the rules — false-positive reports and rule contributions are welcome.

Repo: https://github.com/1689er/exclusion-auditor

Mainly after: feedback on the rule set, and any false positives you hit in your

own environment.

Impact

The tool itself does not represent a vulnerability or threat but addresses a significant security risk area: ungoverned NGAV exclusions that can create blind spots for attackers. By identifying and scoring risky exclusions, it enables defenders to reduce their attack surface and improve endpoint security posture. There are no known exploits or malicious activity associated with the tool. Its impact is positive, helping organizations detect and remediate potentially dangerous configurations that could otherwise be abused.

Defensive guidance

This is a security auditing tool, not a vulnerability requiring patching. No remediation or patch is applicable. Organizations should consider deploying this tool or similar auditing processes to regularly review and manage NGAV exclusions. Since the tool is read-only and designed for safe enterprise use, it can be integrated into security operations without risk of modifying endpoint configurations. Users should follow the tool's documentation for setup and tuning rules to minimize false positives and maximize effectiveness.

Summary

Exclusion Auditor is a vendor-agnostic, read-only CLI tool that audits NGAV/EDR exclusions for security risk and hygiene issues. It normalizes exclusions from various sources (currently CrowdStrike Falcon and generic imports) into a common model and applies a rule engine to detect risky exclusions such as executable/script extensions excluded, root or writable paths excluded, wildcard usage, and LOLBin interpreters excluded. The tool produces detailed reports with severity scoring and supports suppression of accepted findings to reduce noise. It is designed to be safe for enterprise use, requiring only read permissions and no telemetry or credential storage. The tool aims to address the operational challenge that many organizations accumulate numerous ungoverned exclusions that can be exploited by attackers, corresponding to MITRE ATT&CK technique T1562.001 (Impair Defenses).

Exclusion Auditor — open-source, read-only tool to find risky NGAV exclusions (CrowdStrike-first, vendor-agnostic)

Discussion

Links cited in the discussion

Impact

Defensive guidance

Summary

References

Community reviews

Discussion

Links cited in the discussion

AI analysisMachine-generated, updated 25 Jun 2026, 22:16 UTC

Technical details

References

Community reviews

Related threats