Phoenix
Sigma IntelligenceBeta

Search rules

Search the full rule library from any page.

    Back to Rules
    Detectionhighexperimental

    HackTool - Defendnot Execution

    Detects the execution of the hacktool Defendnot. Defendnot is a hacktool that abuses Microsoft undocumented WSC (Windows Security Center) API to disable Windows Defender by registering itself as a fake antivirus product. Threat actors often use these kind of tools to bypass security measures.

    Convert In Phoenix Studio

    Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

    Launch
    Swachchhanda Shrawan Poudel (Nextron Systems)Created Sun Sep 270aaa9689-9f38-491d-bd4d-a9af6eb43138windows
    Log Source
    WindowsProcess Creation
    ProductWindows← raw: windows
    CategoryProcess Creation← raw: process_creation

    Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

    Detection Logic
    Detection Logic1 selector
    detection:
    selection:
        - Image|contains: 'defendnot'
        - CommandLine|contains:
              - 'defendnot'
              - 'https://dnot.sh/'
        - Hashes|contains:
              - 'IMPHASH=1FAAED26690A9455A795E2215661726F'
              - 'IMPHASH=304786466DE25780347A9DCFAF381EF7'
              - 'IMPHASH=55B10396EA722770E51BC288E62179DB'
              - 'IMPHASH=59D65F5EFACBDB1AA2A6CF745B07C058'
              - 'IMPHASH=6CEDEC3562FEF2DC2F959A1D0BF54DB8'
              - 'IMPHASH=75002197E0D24AAF0B8C6A1BF68513D6'
              - 'IMPHASH=7EC4023C85149450AB388F0837192FE0'
              - 'IMPHASH=CA4A3E08E9410A6AEF018424C64C2641'
    condition: selection
    False Positives
    Unlikely

    False positives are unlikely for most environments. High confidence detection.

    References
    1
    Resolving title…
    github.com
    MITRE ATT&CK
    Related Rules
    SimilarDetectionhigh

    HackTool - Defendnot Installation via PowerShell One-Liner

    Detects execution of Defendnot installation via PowerShell one-liner that downloads and executes the Defendnot script from a remote URL. Defendnot is a hacktool that abuses Microsoft's undocumented WSC API to disable Windows Defender by registering itself as a fake antivirus product.

    Detects similar activity. Both rules may fire on overlapping events.

    Rule Metadata
    Rule ID
    0aaa9689-9f38-491d-bd4d-a9af6eb43138
    Status
    experimental
    Level
    high
    Type
    Detection
    Created
    Sun Sep 27
    Author
    Swachchhanda Shrawan Poudel (Nextron Systems)
    Path
    rules/windows/process_creation/proc_creation_win_hktl_defendnot_execution.yml
    Raw Tags
    attack.defense-impairmentattack.t1685
    View on GitHub