Rule Info
Name
HackTool - Defendnot Execution
Author
Swachchhanda Shrawan Poudel (Nextron Systems)
Description
Detects the execution of the hacktool Defendnot. Defendnot is a hacktool that abuses Microsoft undocumented WSC (Windows Security Center) API
to disable Windows Defender by registering itself as a fake antivirus product. Threat actors often use these kind of tools to bypass security measures.
Reference
Date
2026-09-27 00:00:00
Modified
None
Id
0aaa9689-9f38-491d-bd4d-a9af6eb43138
Tags
attack.defense-impairment attack.t1685
Type
Community Rule
Link to Public Repo
Rule History
Author
Title
Date
Commit
Swachchhanda Shrawan Poudel
Merge PR #5469 from @swachchhanda000 - Hacktool - Defendnot Execution
2026-10-19
Scan your endpoints, forensic images or collected files with our portable scanner THOR