huntrule

PowerShell: Defendnot hacktool installation via one-liner fetching dnot.sh

Flags PowerShell one-liners that reference dnot.sh and GitHub/defendnot paths consistent with Defendnot installation.

FreeReviewedSigma · High · v1
Product
windows
Category
ps_script
Author
Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2026-10-18
Updated
2026-10-19
AnalysisDetection

ATT&CK techniques

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags PowerShell script block content that includes the dnot.sh URL and a Defendnot path segment containing /defendnot and a GitHub reference. Such one-liners can download and execute a Defense Evasion component, specifically Defendnot, which is designed to impair Windows Defender by abusing an undocumented WSC API. The detection relies on ScriptBlockText telemetry from PowerShell script execution.

Reporting behind it

Related detections9 linkedT1685 — drag to rearrange
Malicious BYOVD EDR Kill via Renamed GMER Driver by Agonizing Serpens
Malicious ThrottleStop Vulnerable Driver Load for Defense Evasion
Malicious WinRing0 Vulnerable Driver Load for Coin Mining
Windows Security Log: Defendnot scheduled task (defendnot) persistence via --from-autorun
Windows Registry Modification in Security Center AV Provider Keys (ProductEXE/DisplayName/ReportingExe)
Suspicious Security Software Removal Batch Script Execution
Suspicious Silent Security Product Uninstaller Execution
Malicious Antivirus Removal via WMIC Product Uninstall
Malicious Defender Exclusion Added via Add-MpPreference (via process_creation)
PowerShell: Defendnot hacktool installation via one-liner fetching dnot.sh
Pivot detection · T1685 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.