Rule Info
Name
HackTool - Defendnot Installation via PowerShell One-Liner
Author
Swachchhanda Shrawan Poudel (Nextron Systems)
Description
Detects execution of Defendnot installation via PowerShell one-liner that downloads and executes the Defendnot script from a remote URL.
Defendnot is a hacktool that abuses Microsoft's undocumented WSC API to disable Windows Defender by registering itself as a fake antivirus product.
Date
2026-10-18 00:00:00
Modified
None
Id
50b159ba-a147-40f7-9d11-561e724b8a2e
Tags
attack.defense-impairment attack.t1685
Type
Community Rule
Link to Public Repo
Rule History
Author
Title
Date
Commit
Swachchhanda Shrawan Poudel
Merge PR #5469 from @swachchhanda000 - Hacktool - Defendnot Execution
2026-10-19
Scan your endpoints, forensic images or collected files with our portable scanner THOR