Detectionhighexperimental
HackTool - Defendnot Default Scheduled Task Activity
Detects the default scheduled task activity of the hacktool Defendnot, which is used to disable Windows Defender Security. It abuses Microsoft's undocumented WSC API to register itself as a fake antivirus product, allowing it to disable Windows Defender. During installation, Defendnot creates a scheduled task named 'defendnot' with the argument '--from-autorun' for persistence.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Swachchhanda Shrawan Poudel (Nextron Systems)Created Sun Oct 18015ff932-4156-41ae-9d4c-1443995611fdwindows
Log Source
Windowssecurity
ProductWindows← raw: windows
Servicesecurity← raw: security
Detection Logic
Detection Logic2 selectors
detection:
selection_eid:
EventID:
- 4698
- 4702
selection_task:
- TaskName: '\defendnot'
- TaskContent|contains:
- 'defendnot'
- '<Arguments>--from-autorun</Arguments>'
condition: all of selection_*False Positives
Unknown
False positive likelihood has not been assessed. Additional context may be needed during triage.
MITRE ATT&CK
Rule Metadata
Rule ID
015ff932-4156-41ae-9d4c-1443995611fd
Status
experimental
Level
high
Type
Detection
Created
Sun Oct 18
Path
rules/windows/builtin/security/win_security_hktl_defendnot_default_scheduled_task_activity.yml
Raw Tags
attack.executionattack.persistenceattack.privilege-escalationattack.defense-impairmentattack.t1053.005attack.t1685