Full Report
"defendnot" bypasses Windows Defender using undocumented APIs. Learn detection strategies and robust defenses against this sophisticated evasion technique.
Analysis Summary
# Tool/Technique: defendnot
## Overview
**defendnot** is a sophisticated evasion tool designed to disable Windows Defender by registering a fabricated antivirus product with the Windows Security Center (WSC). Instead of using common methods like registry modification or Group Policy manipulation, it leverages undocumented WSC COM interfaces to trick the operating system into believing a third-party antivirus is active, which automatically places Windows Defender into a disabled state.
## Technical Details
- **Type:** Attack Tool / Evasion Technique
- **Platform:** Windows (Workstation versions; not functional on Windows Server due to lack of WSC support)
- **Capabilities:** Disabling Windows Defender, Process Injection, Reverse Engineering of WSC signature validation.
- **First Seen:** May 2025 (Publicly documented via Huntress/es3n1n)
## MITRE ATT&CK Mapping
- **[TA0005 - Defense Evasion]**
- **[T1562.001 - Impair Defenses: Disable or Modify Tools]**
- **[T1055 - Process Injection]**
- **[T1106 - Native API]**
- **[TA0003 - Persistence]**
- **[T1547 - Boot or Logon Autostart Execution]** (Tool requires persistence on disk to remain active)
## Functionality
### Core Capabilities
- **AV Registration:** Uses the undocumented `IWscAvStatus` COM interface to register a fake security product.
- **Status Manipulation:** Invokes `UpdateStatus` to signal to Windows that the fake AV is operational and protecting the system.
- **Signature Bypass:** Replicates the WSC signature validation checks required for legitimate antivirus vendors, allowing it to bypass "Protected Process" restrictions.
### Advanced Features
- **Targeted Injection:** Hardcodes `taskmgr.exe` (Task Manager) as the default victim process (`kVictimProcess`) to host the malicious code, as Task Manager possesses the necessary trust level to interact with WSC APIs.
- **Context Generation:** Creates a temporary configuration file (`ctx.bin`) to store encrypted payloads or operational parameters for the injection phase.
## Indicators of Compromise
- **File Names:**
- `defendnot.exe`
- `defendnot.dll`
- `ctx.bin` (Configuration file created during execution)
- **Registry Keys:**
- `HKLM\SOFTWARE\Microsoft\Security Center\Provider\Av\{GUID}` (New entries for the fake AV)
- **Behavioral Indicators:**
- `taskmgr.exe` spawned as a child process of an unsigned or suspicious binary.
- Unexpected image loads into `taskmgr.exe`.
- The sudden disabling of `WinDefend` service without corresponding administrative policy changes.
## Associated Threat Actors
- **es3n1n** (Tool Developer/Researcher)
- The tool is publicly available on GitHub, making it accessible to various commodity malware authors and red teamers.
## Detection Methods
- **Signature-based detection:**
- Microsoft detects the tool as `VirTool:Win64/Defnot.A`.
- Use of the specific YARA rule provided by Huntress for `defendnot` binaries.
- **Behavioral detection:**
- Monitoring for the creation of `ctx.bin` in temporary directories.
- Detection of `taskmgr.exe` being launched with unusual command-line arguments or by non-standard parent processes.
- Sigma rules targeting the registration of new AV providers in the Windows Security Center registry path.
## Mitigation Strategies
- **Prevention measures:** Implement EDR solutions that monitor for "cross-process" activity and undocumented API calls.
- **Hardening recommendations:**
- Restrict administrative privileges to prevent the execution of tools that require high-integrity contexts for injection.
- Utilize Windows Defender Application Control (WDAC) to prevent unsigned binaries from executing.
- **File Integrity Monitoring:** Monitor for changes to the `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Provider` registry hive.
## Related Tools/Techniques
- **no-defender:** The predecessor tool by the same author (removed via DMCA).
- **AV-Killer/KillAV:** General category of malware designed to terminate security software processes.