HackTool - Defendnot Default Scheduled Task Activity

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects the default scheduled task activity of the hacktool Defendnot, which is used to disable Windows Defender Security. It abuses Microsoft's undocumented WSC API to register itself as a fake antivirus product, allowing it to disable Windows Defender. During installation, Defendnot creates a scheduled task named 'defendnot' with the argument '--from-autorun' for persistence.

2026-10-18 00:00:00

None

015ff932-4156-41ae-9d4c-1443995611fd

attack.execution attack.persistence attack.privilege-escalation attack.defense-impairment attack.t1053.005 attack.t1685

Community Rule

Swachchhanda Shrawan Poudel

Merge PR #5469 from @swachchhanda000 - Hacktool - Defendnot Execution

2026-10-19