PowerShell: Defendnot hacktool installation via one-liner fetching dnot.sh

ATT&CK techniques

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags PowerShell script block content that includes the dnot.sh URL and a Defendnot path segment containing /defendnot and a GitHub reference. Such one-liners can download and execute a Defense Evasion component, specifically Defendnot, which is designed to impair Windows Defender by abusing an undocumented WSC API. The detection relies on ScriptBlockText telemetry from PowerShell script execution.

Reporting behind it

Related detections9 linkedT1685 — drag to rearrange

Malicious BYOVD EDR Kill via Renamed GMER Driver by Agonizing Serpens

Malicious ThrottleStop Vulnerable Driver Load for Defense Evasion

Malicious WinRing0 Vulnerable Driver Load for Coin Mining

Windows Security Log: Defendnot scheduled task (defendnot) persistence via --from-autorun

Windows Registry Modification in Security Center AV Provider Keys (ProductEXE/DisplayName/ReportingExe)

Suspicious Security Software Removal Batch Script Execution

Suspicious Silent Security Product Uninstaller Execution

Malicious Antivirus Removal via WMIC Product Uninstall

Malicious Defender Exclusion Added via Add-MpPreference (via process_creation)

PowerShell: Defendnot hacktool installation via one-liner fetching dnot.sh

Pivot detection · T1685 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

powershell-defendnot-hacktool-installation-via-one-liner-fetching-dnot-sh-50b159ba

title: "PowerShell: Defendnot hacktool installation via one-liner fetching dnot.sh"
id: 419821f3-86da-46b1-99cd-049575895a88
related:
  - id: 0aaa9689-9f38-491d-bd4d-a9af6eb43138
    type: similar
  - id: 50b159ba-a147-40f7-9d11-561e724b8a2e
    type: derived
status: experimental
description: This rule flags PowerShell script block content that includes the dnot.sh URL and a Defendnot path segment containing /defendnot and a GitHub reference. Such one-liners can download and execute a Defense Evasion component, specifically Defendnot, which is designed to impair Windows Defender by abusing an undocumented WSC API. The detection relies on ScriptBlockText telemetry from PowerShell script execution.
references:
  - https://github.com/es3n1n/defendnot/blob/525176a37721ead27d3f9f77f59b58abfc305988/README.md#one-liner
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_hktl_defendnot_installation.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-10-18
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  category: ps_script
  product: windows
detection:
  selection:
    - ScriptBlockText|contains: https://dnot.sh/
    - ScriptBlockText|contains|all:
        - /defendnot
        - github
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL