HackTool - Defendnot Default Scheduled Task Activity

title: HackTool - Defendnot Default Scheduled Task Activity
id: 015ff932-4156-41ae-9d4c-1443995611fd
status: experimental
description: |
    Detects the default scheduled task activity of the hacktool Defendnot, which is used to disable Windows Defender Security.
    It abuses Microsoft's undocumented WSC API to register itself as a fake antivirus product, allowing it to disable Windows Defender.
    During installation, Defendnot creates a scheduled task named 'defendnot' with the argument '--from-autorun' for persistence.
references:
    - https://github.com/es3n1n/defendnot/blob/525176a37721ead27d3f9f77f59b58abfc305988/README.md
    - https://www.huntress.com/blog/defendnot-detecting-malicious-security-product-bypass-techniques
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2026-10-18
tags:
    - attack.execution
    - attack.persistence
    - attack.privilege-escalation
    - attack.defense-impairment
    - attack.t1053.005
    - attack.t1685
logsource:
    product: windows
    service: security
detection:
    selection_eid:
        EventID:
            - 4698
            - 4702
    selection_task:
        - TaskName: '\defendnot'
        - TaskContent|contains:
              - 'defendnot'
              - '<Arguments>--from-autorun</Arguments>'
    condition: all of selection_*
falsepositives:
    - Unknown
level: high