huntrule

Windows: Detect Defendnot HackTool Process Execution

Alerts on Windows process executions referencing Defendnot, including its URL and known IMPHASH values.

FreeReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2026-09-27
Updated
2026-10-19
AnalysisDetection

ATT&CK techniques

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags process creation events where the executable or command line contains “defendnot” and where the command line includes “https://dnot.sh/”. It also matches specific IMPHASH values associated with known Defendnot binaries. This matters because Defendnot is designed to impair Windows defenses, and attackers may use such tools to disable or bypass security controls. The detection relies on Windows process creation telemetry, including image path, command line, and file hash impersonation (IMPHASH).

Reporting behind it

Related detections9 linkedT1685 — drag to rearrange
Malicious BYOVD EDR Kill via Renamed GMER Driver by Agonizing Serpens
Malicious ThrottleStop Vulnerable Driver Load for Defense Evasion
Malicious WinRing0 Vulnerable Driver Load for Coin Mining
Windows Security Log: Defendnot scheduled task (defendnot) persistence via --from-autorun
PowerShell: Defendnot hacktool installation via one-liner fetching dnot.sh
Windows Registry Modification in Security Center AV Provider Keys (ProductEXE/DisplayName/ReportingExe)
Suspicious Security Software Removal Batch Script Execution
Suspicious Silent Security Product Uninstaller Execution
Malicious Antivirus Removal via WMIC Product Uninstall
Windows: Detect Defendnot HackTool Process Execution
Pivot detection · T1685 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.