Loading story…
DefendNot, a Windows defense-evasion tool, abuses Windows Security Center (WSC) antivirus-registration interfaces to present itself as a third-party antivirus product. Because Microsoft Defender normally transitions to passive mode when WSC recognizes another antivirus provider, the technique can reduce or suppress Defender protection without deploying a legitimate competing security product. DefendNot 1.6.0 registers its default fake provider as dnot.sh and uses interfaces including IWscAVStatus4 methods such as Register, UpdateStatus, RegisterAV, and UpdateStatusAV.
Defenders can hunt for DefendNot through its execution artifacts, DLL loading or injection into Task Manager, scheduled-task persistence, Security Center antivirus-provider registry modifications, and Microsoft Defender policy tampering. Relevant telemetry includes Windows Security and Defender Operational logs and Sysmon events covering process activity, module loads, scheduled tasks, and registry changes; organizations should investigate unexpected WSC antivirus registrations, particularly where no approved endpoint-security product is installed.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
A security post described abusing the Windows Security Center API to fraudulently register a third-party antivirus product, causing Windows Defender to enter passive mode or reduce protections. The post did not identify a CVE, named threat actor, victim, malware family, or active exploitation campaign.
Purple Team published analysis and detection guidance for DefendNot 1.6.0, a tool that registers a fake antivirus product with Windows Security Center to alter Microsoft Defender protection behavior. The guidance documented artifacts including the fake AV name "dnot.sh," Task Manager DLL loading or injection, scheduled-task persistence, registry changes, and Defender telemetry to hunt.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A developer published **Defendnot**, a Windows tool that disables Microsoft Defender by registering itself with **Windows Security Center (WSC)** as if it were a legitimate third-party antivirus product. The accompanying write-up says the method was developed through reverse engineering of the undocumented WSC API, allowing Defender to stand down automatically when the fake product is recognized by the operating system. The GitHub project includes PowerShell-based deployment and command-line options to enable, disable, and persist the tool through autorun, while noting important limits and detection details. The author states that Microsoft Defender detects the utility as **`VirTool:Win64/Defnot.A`**, installation may require real-time and tamper protection to be turned off, the technique does not work on **Windows Server** because WSC is not present there, and persistence across reboots depends on keeping the binaries on disk.
Aug 15, 2026
Attackers are modifying Microsoft Defender Antivirus exclusion settings to prevent malware from being scanned while leaving Defender enabled, evading real-time, scheduled, and on-demand protections. The technique requires administrator-level access and can be deployed through PowerShell, WMI, Group Policy, or direct policy-registry changes; broad path or file-extension exclusions can shield malware staging locations and payloads. Huntress linked the behavior to activity involving GootKit, WhisperGate, and Muddled Libra. Defender policies can conceal configured exclusions from PowerShell queries, including those executed as `SYSTEM`, limiting the reliability of routine endpoint inspection. Security teams should monitor for newly created exclusions, especially exclusions covering entire drives, broad extensions, or staging directories, and investigate modifications to the `HideExclusionsFromLocalAdmins` policy. Incident responders should validate both local and Group Policy registry locations directly rather than relying solely on Defender or PowerShell output.
Oct 1, 2026
Two separate Windows-focused research writeups describe practical **evasion techniques against Microsoft Defender/EDR**. One demonstrates bypassing Defender’s signature-based detections by constructing suspicious strings (e.g., `Invoke-Mimikatz`) at runtime using PowerShell character encoding/concatenation (`[char]NN`), reporting reliable evasion in a fully updated Windows 10/11 environment with real-time protection and script scanning enabled. A second report covers **EDRStartupHinder**, a newly released tool by researcher **TwoSevenOneT** that aims to prevent antivirus/EDR services from starting cleanly on boot (demonstrated against Defender on Windows 11 25H2). The technique uses a higher-priority Windows service and **Bindlink** redirection of a selected `System32` DLL to a tampered (“corrupted”) copy so the protected EDR process (e.g., `MsMpEng.exe`, running as **PPL**) fails to load required dependencies and crashes at startup; the article notes operator requirements such as choosing a DLL not in `KnownDLLs` and identifying service group order via `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ServiceGroupOrder` and tooling like Process Monitor/Process Explorer boot logs.
Jun 29, 2026