Windows: Detect Defendnot HackTool Process Execution

ATT&CK techniques

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process creation events where the executable or command line contains “defendnot” and where the command line includes “https://dnot.sh/”. It also matches specific IMPHASH values associated with known Defendnot binaries. This matters because Defendnot is designed to impair Windows defenses, and attackers may use such tools to disable or bypass security controls. The detection relies on Windows process creation telemetry, including image path, command line, and file hash impersonation (IMPHASH).

Reporting behind it

Related detections9 linkedT1685 — drag to rearrange

Malicious BYOVD EDR Kill via Renamed GMER Driver by Agonizing Serpens

Malicious ThrottleStop Vulnerable Driver Load for Defense Evasion

Malicious WinRing0 Vulnerable Driver Load for Coin Mining

Windows Security Log: Defendnot scheduled task (defendnot) persistence via --from-autorun

PowerShell: Defendnot hacktool installation via one-liner fetching dnot.sh

Windows Registry Modification in Security Center AV Provider Keys (ProductEXE/DisplayName/ReportingExe)

Suspicious Security Software Removal Batch Script Execution

Suspicious Silent Security Product Uninstaller Execution

Malicious Antivirus Removal via WMIC Product Uninstall

Windows: Detect Defendnot HackTool Process Execution

Pivot detection · T1685 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-detect-defendnot-hacktool-process-execution-0aaa9689

title: "Windows: Detect Defendnot HackTool Process Execution"
id: e3afa447-2272-4c1b-ad3e-b56e8586699c
related:
  - id: 50b159ba-a147-40f7-9d11-561e724b8a2e
    type: similar
  - id: 0aaa9689-9f38-491d-bd4d-a9af6eb43138
    type: derived
status: experimental
description: This rule flags process creation events where the executable or command line contains “defendnot” and where the command line includes “https://dnot.sh/”. It also matches specific IMPHASH values associated with known Defendnot binaries. This matters because Defendnot is designed to impair Windows defenses, and attackers may use such tools to disable or bypass security controls. The detection relies on Windows process creation telemetry, including image path, command line, and file hash impersonation (IMPHASH).
references:
  - https://github.com/es3n1n/defendnot/blob/525176a37721ead27d3f9f77f59b58abfc305988/README.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_defendnot_execution.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-09-27
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|contains: defendnot
    - CommandLine|contains:
        - defendnot
        - https://dnot.sh/
    - Hashes|contains:
        - IMPHASH=1FAAED26690A9455A795E2215661726F
        - IMPHASH=304786466DE25780347A9DCFAF381EF7
        - IMPHASH=55B10396EA722770E51BC288E62179DB
        - IMPHASH=59D65F5EFACBDB1AA2A6CF745B07C058
        - IMPHASH=6CEDEC3562FEF2DC2F959A1D0BF54DB8
        - IMPHASH=75002197E0D24AAF0B8C6A1BF68513D6
        - IMPHASH=7EC4023C85149450AB388F0837192FE0
        - IMPHASH=CA4A3E08E9410A6AEF018424C64C2641
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL