HackTool - Defendnot Default Scheduled Task Activity

SigmaHQ Detections@sigmaHQ

•updated 3 days ago•0•0•1

Detects the default scheduled task activity of the hacktool Defendnot, which is used to disable Windows Defender Security. It abuses Microsoft's undocumented WSC API to register itself as a fake antivirus product, allowing it to disable Windows Defender. During installation, Defendnot creates a scheduled task named 'defendnot' with the argument '--from-autorun' for persistence.