HackTool - Defendnot Default Scheduled Task Activity

Title: HackTool - Defendnot Default Scheduled Task Activity
Status: experimental
Description:Detects the default scheduled task activity of the hacktool Defendnot, which is used to disable Windows Defender Security. It abuses Microsoft's undocumented WSC API to register itself as a fake antivirus product, allowing it to disable Windows Defender. During installation, Defendnot creates a scheduled task named 'defendnot' with the argument '--from-autorun' for persistence.
References:
  -https://github.com/es3n1n/defendnot/blob/525176a37721ead27d3f9f77f59b58abfc305988/README.md
  -https://www.huntress.com/blog/defendnot-detecting-malicious-security-product-bypass-techniques
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2026-10-18
modified:None
Tags:

• -'attack.execution'
• -'attack.persistence'
• -'attack.privilege-escalation'
• -'attack.defense-impairment'
• -'attack.t1053.005'
• -'attack.t1685'

Logsource:

• product: windows
• service: security

Detection:
  selection_eid:
    EventID:
      -'4698'
      -'4702'

  selection_task:
TaskName:'\defendnot'     - TaskContent|contains:
      - 'defendnot'
      - '<Arguments>--from-autorun</Arguments>'
  condition:all of selection_*
Falsepositives:
  -Unknown
Level: high