HackTool - Defendnot Default Scheduled Task Activity

 1title: HackTool - Defendnot Default Scheduled Task Activity
 2id: 015ff932-4156-41ae-9d4c-1443995611fd
 3status: experimental
 4description: |
 5    Detects the default scheduled task activity of the hacktool Defendnot, which is used to disable Windows Defender Security.
 6    It abuses Microsoft's undocumented WSC API to register itself as a fake antivirus product, allowing it to disable Windows Defender.
 7    During installation, Defendnot creates a scheduled task named 'defendnot' with the argument '--from-autorun' for persistence.    
 8references:
 9    - https://github.com/es3n1n/defendnot/blob/525176a37721ead27d3f9f77f59b58abfc305988/README.md
10    - https://www.huntress.com/blog/defendnot-detecting-malicious-security-product-bypass-techniques
11author: Swachchhanda Shrawan Poudel (Nextron Systems)
12date: 2026-10-18
13tags:
14    - attack.execution
15    - attack.persistence
16    - attack.privilege-escalation
17    - attack.defense-impairment
18    - attack.t1053.005
19    - attack.t1685
20logsource:
21    product: windows
22    service: security
23detection:
24    selection_eid:
25        EventID:
26            - 4698
27            - 4702
28    selection_task:
29        - TaskName: '\defendnot'
30        - TaskContent|contains:
31              - 'defendnot'
32              - '<Arguments>--from-autorun</Arguments>'
33    condition: all of selection_*
34falsepositives:
35    - Unknown
36level: high