HackTool - Defendnot Installation via PowerShell One-Liner

Description

Detects execution of Defendnot installation via PowerShell one-liner that downloads and executes the Defendnot script from a remote URL. Defendnot is a hacktool that abuses Microsoft's undocumented WSC API to disable Windows Defender by registering itself as a fake antivirus product.

Query · sigma

selection:
- ScriptBlockText|contains: https://dnot.sh/
- ScriptBlockText|contains|all:
  - /defendnot
  - github
condition: selection

Known false positives

Unlikely

Detection tier

Atomic IOCs

The whole rule is one thing the adversary controls: a domain, an IP, a file hash. It stops working the moment that value rotates. Collapses the pyramid's bottom three rungs, which structure cannot reliably tell apart. Hidden by default: useful for asking 'has anyone seen this?', misleading as a measure of coverage.
Network & Host Artifacts

A URI shape, a user-agent, a registry path. These are the marks left behind when the adversary's tooling runs. Survives the rotation of any single domain or hash; breaks when the tool is reconfigured.
Tools

Identifies the software rather than the traces of it. Most YARA rules sit here, as do Suricata rules keyed on a hardcoded user-agent. Costs the adversary a rebuild or a new tool.
TTPs

Describes the action rather than anything the adversary owns or used: a process spawning another, a sequence of events, a join across other detections. Survives a tool swap, and the rung worth comparing across sources.
Pending classification

A classifier read the rule and structure alone did not settle it. Every rule in the index has been examined and none is skipped, so these are held for a later pass rather than guessed at. A wrong rung is worse than none. Concentrated in the formats whose rules say least about what they key on.

Metadata

Source: SigmaHQ/sigma
License: Detection Rule License 1.1
Severity: High
Status: Experimental
Query type: sigma
Created: 2026-10-18
Modified: 2026-10-19
Authored by: Swachchhanda Shrawan Poudel (Nextron Systems)
Source ID
Upstream: rules/windows/powershell/powershell_script/posh_ps_hktl_defendnot_installation.yml
References: https://github.com/es3n1n/defendnot/blob/525176a37721ead27d3f9f77f59b58abfc305988/README.md#one-liner
Data sources: ps_script
Platforms: windows

ATT&CK

T1685