HackTool - Defendnot Execution

 1title: HackTool - Defendnot Execution
 2id: 0aaa9689-9f38-491d-bd4d-a9af6eb43138
 3related:
 4    - id: 50b159ba-a147-40f7-9d11-561e724b8a2e
 5      type: similar
 6status: experimental
 7description: |
 8    Detects the execution of the hacktool Defendnot. Defendnot is a hacktool that abuses Microsoft undocumented WSC (Windows Security Center) API
 9    to disable Windows Defender by registering itself as a fake antivirus product. Threat actors often use these kind of tools to bypass security measures.    
10references:
11    - https://github.com/es3n1n/defendnot/blob/525176a37721ead27d3f9f77f59b58abfc305988/README.md
12author: Swachchhanda Shrawan Poudel (Nextron Systems)
13date: 2026-09-27
14tags:
15    - attack.defense-impairment
16    - attack.t1685
17logsource:
18    category: process_creation
19    product: windows
20detection:
21    selection:
22        - Image|contains: 'defendnot'
23        - CommandLine|contains:
24              - 'defendnot'
25              - 'https://dnot.sh/'
26        - Hashes|contains:
27              - 'IMPHASH=1FAAED26690A9455A795E2215661726F'
28              - 'IMPHASH=304786466DE25780347A9DCFAF381EF7'
29              - 'IMPHASH=55B10396EA722770E51BC288E62179DB'
30              - 'IMPHASH=59D65F5EFACBDB1AA2A6CF745B07C058'
31              - 'IMPHASH=6CEDEC3562FEF2DC2F959A1D0BF54DB8'
32              - 'IMPHASH=75002197E0D24AAF0B8C6A1BF68513D6'
33              - 'IMPHASH=7EC4023C85149450AB388F0837192FE0'
34              - 'IMPHASH=CA4A3E08E9410A6AEF018424C64C2641'
35    condition: selection
36falsepositives:
37    - Unlikely
38level: high