Detectionhighexperimental

HackTool - Defendnot Installation via PowerShell One-Liner

Detects execution of Defendnot installation via PowerShell one-liner that downloads and executes the Defendnot script from a remote URL. Defendnot is a hacktool that abuses Microsoft's undocumented WSC API to disable Windows Defender by registering itself as a fake antivirus product.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Swachchhanda Shrawan Poudel (Nextron Systems)Created Sun Oct 1850b159ba-a147-40f7-9d11-561e724b8a2ewindows

Log Source

WindowsPowerShell Script

ProductWindows← raw: windows

CategoryPowerShell Script← raw: ps_script

Detection Logic

detection:
    selection:
        - ScriptBlockText|contains: 'https://dnot.sh/'
        - ScriptBlockText|contains|all:
              - '/defendnot'
              - 'github' # covers both api.github.com and raw.githubusercontent.com
    condition: selection

False Positives

Unlikely

False positives are unlikely for most environments. High confidence detection.

References

Resolving title…

github.com

MITRE ATT&CK

Tactics

TA0112 · Defense Impairment

Techniques

T1685 · Disable or Modify Tools

Related Rules

SimilarDetectionhigh

HackTool - Defendnot Execution

Detects the execution of the hacktool Defendnot. Defendnot is a hacktool that abuses Microsoft undocumented WSC (Windows Security Center) API to disable Windows Defender by registering itself as a fake antivirus product. Threat actors often use these kind of tools to bypass security measures.

Detects similar activity. Both rules may fire on overlapping events.

Rule Metadata

Rule ID

50b159ba-a147-40f7-9d11-561e724b8a2e

Status

experimental

Level

high

Type

Detection

Created

Sun Oct 18

Author

Swachchhanda Shrawan Poudel (Nextron Systems)

Path

rules/windows/powershell/powershell_script/posh_ps_hktl_defendnot_installation.yml

Raw Tags

attack.defense-impairmentattack.t1685

View on GitHub