Loading story…
A developer published Defendnot, a Windows tool that disables Microsoft Defender by registering itself with Windows Security Center (WSC) as if it were a legitimate third-party antivirus product. The accompanying write-up says the method was developed through reverse engineering of the undocumented WSC API, allowing Defender to stand down automatically when the fake product is recognized by the operating system.
The GitHub project includes PowerShell-based deployment and command-line options to enable, disable, and persist the tool through autorun, while noting important limits and detection details. The author states that Microsoft Defender detects the utility as VirTool:Win64/Defnot.A, installation may require real-time and tamper protection to be turned off, the technique does not work on Windows Server because WSC is not present there, and persistence across reboots depends on keeping the binaries on disk.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
A GitHub repository for Defendnot is published, providing code and instructions for disabling Microsoft Defender by registering through WSC as another antivirus product. The repository documents installation, persistence via autorun, platform limitations, and notes Microsoft Defender detects the tool as VirTool:Win64/Defnot.A.
A blog post describes reverse engineering the undocumented Windows Security Center API to register a fake antivirus product so Windows disables Microsoft Defender. The work is presented as the basis for the Defendnot approach and as a successor to an earlier no-defender implementation that relied on third-party antivirus code.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
DefendNot, a Windows defense-evasion tool, abuses Windows Security Center (WSC) antivirus-registration interfaces to present itself as a third-party antivirus product. Because Microsoft Defender normally transitions to passive mode when WSC recognizes another antivirus provider, the technique can reduce or suppress Defender protection without deploying a legitimate competing security product. DefendNot 1.6.0 registers its default fake provider as `dnot.sh` and uses interfaces including `IWscAVStatus4` methods such as `Register`, `UpdateStatus`, `RegisterAV`, and `UpdateStatusAV`. Defenders can hunt for DefendNot through its execution artifacts, DLL loading or injection into Task Manager, scheduled-task persistence, Security Center antivirus-provider registry modifications, and Microsoft Defender policy tampering. Relevant telemetry includes Windows Security and Defender Operational logs and Sysmon events covering process activity, module loads, scheduled tasks, and registry changes; organizations should investigate unexpected WSC antivirus registrations, particularly where no approved endpoint-security product is installed.
Sep 10, 2026
Two separate Windows-focused research writeups describe practical **evasion techniques against Microsoft Defender/EDR**. One demonstrates bypassing Defender’s signature-based detections by constructing suspicious strings (e.g., `Invoke-Mimikatz`) at runtime using PowerShell character encoding/concatenation (`[char]NN`), reporting reliable evasion in a fully updated Windows 10/11 environment with real-time protection and script scanning enabled. A second report covers **EDRStartupHinder**, a newly released tool by researcher **TwoSevenOneT** that aims to prevent antivirus/EDR services from starting cleanly on boot (demonstrated against Defender on Windows 11 25H2). The technique uses a higher-priority Windows service and **Bindlink** redirection of a selected `System32` DLL to a tampered (“corrupted”) copy so the protected EDR process (e.g., `MsMpEng.exe`, running as **PPL**) fails to load required dependencies and crashes at startup; the article notes operator requirements such as choosing a DLL not in `KnownDLLs` and identifying service group order via `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ServiceGroupOrder` and tooling like Process Monitor/Process Explorer boot logs.
Jun 29, 2026
Ransomware operators have repeatedly used tools and policy abuse to disable Microsoft Defender before encrypting Windows environments. DFIR reporting documented the freeware utility **Defender Control** being used in real intrusions by groups such as **Dharma**, **Phobos**, and **Crysis**, typically after access through exposed RDP, to turn off Defender through registry edits, service changes, driver unloading, and local group policy modifications. Separately, **LockBit 2.0** automated the same objective at enterprise scale by creating malicious Active Directory group policies on a domain controller, disabling Defender across domain-joined systems, and launching ransomware via scheduled tasks after enumerating hosts with AD and LDAP queries. More recent intrusions show the tactic evolving beyond simple utilities into **BYOVD** and broader policy abuse. WithSecure reported that the **CrazyHunter** ransomware actor used the vulnerable **Zemana Anti-Logger** driver `zam64.sys` to disable both Windows Defender and Trend Micro during attacks on Taiwanese hospitals and industrial organizations, including the Mackay Memorial Hospital incident. The operation also used publicly available tooling such as **SharpGPOAbuse** for lateral movement and persistence, reinforcing that defense evasion through Defender tampering and group policy manipulation remains a practical, low-barrier technique for ransomware actors ranging from smaller crews to more organized operators.
Aug 14, 2026