Windows Security Log: Defendnot scheduled task (defendnot) persistence via --from-autorun
Detects Defendnot persistence by alerting on scheduled task create/update activity for \defendnot with --from-autorun.
- Product
- windows
- Service
- security
- Author
- Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2026-10-18
- Updated
- 2026-10-19
ATT&CK techniques
Execution → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags creation or modification of a Windows scheduled task named \defendnot where the task content includes Arguments with --from-autorun. Attackers can use this Defendnot behavior to establish persistence while impairing security by leveraging a mechanism intended to bypass Windows Defender. The detection relies on Windows Security auditing events 4698 and 4702 and inspection of scheduled task XML content in the task payload.
Reporting behind it
- github.comhttps://github.com/es3n1n/defendnot/blob/525176a37721ead27d3f9f77f59b58abfc305988/README.md
- huntress.comhttps://www.huntress.com/blog/defendnot-detecting-malicious-security-product-bypass-techniques
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_hktl_defendnot_default_scheduled_task_activity.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Security Log: Defendnot scheduled task (defendnot) persistence via --from-autorun"
id: 1f10a4c8-e382-4dd7-8a69-0dcd4b3e4279
status: experimental
description: This rule flags creation or modification of a Windows scheduled task named \defendnot where the task content includes Arguments with --from-autorun. Attackers can use this Defendnot behavior to establish persistence while impairing security by leveraging a mechanism intended to bypass Windows Defender. The detection relies on Windows Security auditing events 4698 and 4702 and inspection of scheduled task XML content in the task payload.
references:
- https://github.com/es3n1n/defendnot/blob/525176a37721ead27d3f9f77f59b58abfc305988/README.md
- https://www.huntress.com/blog/defendnot-detecting-malicious-security-product-bypass-techniques
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_hktl_defendnot_default_scheduled_task_activity.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-10-18
tags:
- attack.execution
- attack.persistence
- attack.privilege-escalation
- attack.defense-impairment
- attack.t1053.005
- attack.t1685
logsource:
product: windows
service: security
detection:
selection_eid:
EventID:
- 4698
- 4702
selection_task:
- TaskName: \defendnot
- TaskContent|contains:
- defendnot
- <Arguments>--from-autorun</Arguments>
condition: all of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 015ff932-4156-41ae-9d4c-1443995611fd
type: derived