HackTool - Defendnot Default Scheduled Task Activity

Detects the default scheduled task activity of the hacktool Defendnot, which is used to disable Windows Defender Security. It abuses Microsoft's undocumented WSC API to register itself as a fake antivirus product, allowing it to disable Windows Defender. During installation, Defendnot creates a scheduled task named 'defendnot' with the argument '--from-autorun' for persistence.

title: HackTool - Defendnot Default Scheduled Task Activity
id: 015ff932-4156-41ae-9d4c-1443995611fd
status: experimental
description: |
    Detects the default scheduled task activity of the hacktool Defendnot, which is used to disable Windows Defender Security.
    It abuses Microsoft's undocumented WSC API to register itself as a fake antivirus product, allowing it to disable Windows Defender.
    During installation, Defendnot creates a scheduled task named 'defendnot' with the argument '--from-autorun' for persistence.
references:
    - https://github.com/es3n1n/defendnot/blob/525176a37721ead27d3f9f77f59b58abfc305988/README.md
    - https://www.huntress.com/blog/defendnot-detecting-malicious-security-product-bypass-techniques
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2026-10-18
tags:
    - attack.execution
    - attack.persistence
    - attack.privilege-escalation
    - attack.defense-impairment
    - attack.t1053.005
    - attack.t1685
logsource:
    product: windows
    service: security
detection:
    selection_eid:
        EventID:
            - 4698
            - 4702
    selection_task:
        - TaskName: '\defendnot'
        - TaskContent|contains:
              - 'defendnot'
              - '<Arguments>--from-autorun</Arguments>'
    condition: all of selection_*
falsepositives:
    - Unknown
level: high

• T1053.005Scheduled Task
• T1685Disable or Modify Tools

• https://github.com/es3n1n/defendnot/blob/525176a37721ead27d3f9f77f59b58abfc305988/README.md↗
• https://www.huntress.com/blog/defendnot-detecting-malicious-security-product-bypass-techniques↗