Sigma rule: HackTool - Defendnot Default Scheduled Task Activity

Rule

Title

HackTool - Defendnot Default Scheduled Task Activity

Status

experimental

Level

high

Author

Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2026-10-18

File

rules/windows/builtin/security/win_security_hktl_defendnot_default_scheduled_task_activity.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the default scheduled task activity of the hacktool Defendnot, which is used to disable Windows Defender Security.
It abuses Microsoft's undocumented WSC API to register itself as a fake antivirus product, allowing it to disable Windows Defender.
During installation, Defendnot creates a scheduled task named 'defendnot' with the argument '--from-autorun' for persistence.

Log source

product

windows

service

security

Detection

selection_eid:
    EventID:
        - 4698
        - 4702
selection_task:
    - TaskName: '\defendnot'
    - TaskContent|contains:
          - 'defendnot'
          - '<Arguments>--from-autorun</Arguments>'
condition: all of selection_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.execution
• attack.persistence
• attack.privilege-escalation
• attack.defense-impairment
• attack.t1053.005
• attack.t1685

MITRE ATT&CK ids this rule names

• T1053.005
• T1685

References

• https://github.com/es3n1n/defendnot/blob/525176a37721ead27d3f9f77f59b58abfc305988/README.md
• https://www.huntress.com/blog/defendnot-detecting-malicious-security-product-bypass-techniques

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/builtin/security/win_security_hktl_defendnot_default_scheduled_task_activity.yml