{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/security-center/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["medium"],"_cs_tags":["defense-impairment","windows","registry","security-center"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eAdversaries often attempt to impair security defenses by manipulating the Windows Security Center (WSC) to mask their presence or facilitate the deployment of malicious tools. By modifying registry keys located under 'HKLM\\SOFTWARE\\Microsoft\\Security Center\\Provider\\Av', attackers can register fake or misleading antivirus product information, such as the 'DisplayName', 'ProductEXE', or 'ReportingExe' values. This technique, often referred to as \u0026quot;Defendnot,\u0026quot; aims to trick the operating system and monitoring tools into believing a legitimate security product is active, effectively bypassing security software detection or silencing alerts. This behavior is typically observed in the context of post-exploitation toolkits seeking to maintain persistence and evade endpoint detection and response (EDR) agents.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful manipulation of Security Center registry keys can lead to the successful deployment of secondary payloads, prolonged dwell time, and the potential for complete system compromise due to the blinding of security telemetry and defensive controls.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the provided Sigma rule to your SIEM to monitor for unauthorized writes to WSC registry keys.\u003c/li\u003e\n\u003cli\u003eBaseline the 'Details' field in your environment to identify legitimate antivirus installers that may not be included in the default filter list.\u003c/li\u003e\n\u003cli\u003eInvestigate any process other than 'svchost.exe' attempting to modify these specific registry keys.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-19T09:50:11Z","date_published":"2026-10-19T09:50:11Z","id":"https://feed.craftedsignal.io/briefs/2026-10-defendnot-security-center/","summary":"This detection targets unauthorized modifications to Windows Security Center registry keys used by threat actors to spoof or disable antivirus product reporting.","title":"Detection of Malicious Security Center AV Registry Tampering","url":"https://feed.craftedsignal.io/briefs/2026-10-defendnot-security-center/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["high"],"_cs_tags":["hacktool","persistence","defense-impairment","security-center","windows"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eDefendnot is a hacktool designed to facilitate the impairment of Windows Defender by abusing undocumented Windows Security Center (WSC) APIs. By masquerading as an installed antivirus security provider, the tool tricks the operating system into disabling the legitimate Windows Defender service. This capability significantly lowers the security posture of compromised hosts. To maintain its foothold, the tool utilizes a persistent scheduled task configuration. Security operations teams should prioritize monitoring for the creation of this specific scheduled task, as it serves as a reliable indicator of Defendnot deployment and potential unauthorized security configuration changes on Windows endpoints.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker gains initial access to a Windows system and drops the Defendnot binary.\u003c/li\u003e\n\u003cli\u003eThe binary executes and invokes undocumented WSC APIs to register itself as a security provider.\u003c/li\u003e\n\u003cli\u003eThe registration process identifies the tool as an active antivirus engine, prompting Windows to disable Windows Defender.\u003c/li\u003e\n\u003cli\u003eThe tool executes a schtasks command or API call to create a scheduled task named 'defendnot'.\u003c/li\u003e\n\u003cli\u003eThe scheduled task is configured with the argument '--from-autorun' to ensure persistence across reboots.\u003c/li\u003e\n\u003cli\u003eThe system schedules the task to run the binary repeatedly, ensuring the malicious security provider registration remains active.\u003c/li\u003e\n\u003cli\u003eWindows Defender remains incapacitated, allowing subsequent stages of the attack or unauthorized activity to proceed without interference.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful execution of Defendnot leads to the disabling of Windows Defender, leaving the affected system vulnerable to further exploitation, malware infection, and data exfiltration. The tool directly impairs the host's primary defense-in-depth mechanism. While specific victim counts are not reported, this tool is categorized as a high-risk security impairment utility suitable for post-exploitation persistence and stealth.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the provided Sigma rule to detect the creation of the 'defendnot' scheduled task via Security event logs (EID 4698/4702).\u003c/li\u003e\n\u003cli\u003eUse EDR or forensic tooling to hunt for the presence of the 'defendnot' binary and any associated task registrations.\u003c/li\u003e\n\u003cli\u003eAudit security provider registrations using the Windows Security Center API to identify unauthorized or rogue antivirus entries.\u003c/li\u003e\n\u003cli\u003eBlock the execution of unsigned or unrecognized security-related utilities that interact with the WSC service.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-19T08:54:06Z","date_published":"2026-10-19T08:54:06Z","id":"https://feed.craftedsignal.io/briefs/2026-10-defendnot-scheduled-task/","summary":"The Defendnot hacktool utilizes a custom scheduled task for persistence and abuses the Windows Security Center API to register itself as a fake antivirus product to disable Windows Defender.","title":"Defendnot HackTool Scheduled Task Persistence and Defense Impairment","url":"https://feed.craftedsignal.io/briefs/2026-10-defendnot-scheduled-task/"}],"language":"en","title":"CraftedSignal Threat Feed - Security-Center","version":"https://jsonfeed.org/version/1.1"}