Defendnot

Disable Windows Defender via Antivirus Fake Registration : r/netsec

DefendNot, a Windows defense-evasion tool, abuses Windows Security Center (WSC) antivirus-registration interfaces to present itself as a third-party antivirus product. Because Microsoft Defender normally transitions to passive mode when WSC recognizes another antivirus provider, the technique can reduce or suppress Defender protection without deploying a legitimate competing security product. DefendNot 1.6.0 registers its default fake provider as dnot.sh and uses interfaces including IWscAVStatus4 methods such as Register, UpdateStatus, RegisterAV, and UpdateStatusAV. Defenders can hunt for DefendNot through its execution artifacts, DLL loading or injection into Task Manager, scheduled-task persistence, Security Center antivirus-provider registry modifications, and Microsoft Defender policy tampering. Relevant telemetry includes Windows Security and Defender Operational logs and Sysmon events covering process activity, module loads, scheduled tasks, and registry changes; organizations should investigate unexpected WSC antivirus registrations, particularly where no approved endpoint-security product is installed.

Windows Security Center - Purple Team