HackTool - Defendnot Installation via PowerShell One-Liner

calendar Oct 19, 2026 · attack.defense-impairment attack.t1685  ·
Share on: linkedin copy

Detects execution of Defendnot installation via PowerShell one-liner that downloads and executes the Defendnot script from a remote URL. Defendnot is a hacktool that abuses Microsoft's undocumented WSC API to disable Windows Defender by registering itself as a fake antivirus product.

Sigma rule (View on GitHub)

 1title: HackTool - Defendnot Installation via PowerShell One-Liner
 2id: 50b159ba-a147-40f7-9d11-561e724b8a2e
 3related:
 4    - id: 0aaa9689-9f38-491d-bd4d-a9af6eb43138
 5      type: similar
 6status: experimental
 7description: |
 8    Detects execution of Defendnot installation via PowerShell one-liner that downloads and executes the Defendnot script from a remote URL.
 9    Defendnot is a hacktool that abuses Microsoft's undocumented WSC API to disable Windows Defender by registering itself as a fake antivirus product.    
10references:
11    - https://github.com/es3n1n/defendnot/blob/525176a37721ead27d3f9f77f59b58abfc305988/README.md#one-liner
12author: Swachchhanda Shrawan Poudel (Nextron Systems)
13date: 2026-10-18
14tags:
15    - attack.defense-impairment
16    - attack.t1685
17logsource:
18    category: ps_script
19    product: windows
20detection:
21    selection:
22        - ScriptBlockText|contains: 'https://dnot.sh/'
23        - ScriptBlockText|contains|all:
24              - '/defendnot'
25              - 'github' # covers both api.github.com and raw.githubusercontent.com
26    condition: selection
27falsepositives:
28    - Unlikely
29level: high

References

Related rules

to-top