Security-Center - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/security-center/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 19 Oct 2026 09:50:11 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgDetection of Malicious Security Center AV Registry Tamperinghttps://feed.craftedsignal.io/briefs/2026-10-defendnot-security-center/Mon, 19 Oct 2026 09:50:11 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-defendnot-security-center/This detection targets unauthorized modifications to Windows Security Center registry keys used by threat actors to spoof or disable antivirus product reporting.Adversaries often attempt to impair security defenses by manipulating the Windows Security Center (WSC) to mask their presence or facilitate the deployment of malicious tools. By modifying registry keys located under 'HKLM\SOFTWARE\Microsoft\Security Center\Provider\Av', attackers can register fake or misleading antivirus product information, such as the 'DisplayName', 'ProductEXE', or 'ReportingExe' values. This technique, often referred to as "Defendnot," aims to trick the operating system and monitoring tools into believing a legitimate security product is active, effectively bypassing security software detection or silencing alerts. This behavior is typically observed in the context of post-exploitation toolkits seeking to maintain persistence and evade endpoint detection and response (EDR) agents.

Impact

Successful manipulation of Security Center registry keys can lead to the successful deployment of secondary payloads, prolonged dwell time, and the potential for complete system compromise due to the blinding of security telemetry and defensive controls.

Recommendation

  • Deploy the provided Sigma rule to your SIEM to monitor for unauthorized writes to WSC registry keys.
  • Baseline the 'Details' field in your environment to identify legitimate antivirus installers that may not be included in the default filter list.
  • Investigate any process other than 'svchost.exe' attempting to modify these specific registry keys.
]]>mediumadvisorydefense-impairmentwindowsregistrysecurity-centerDefendnot HackTool Scheduled Task Persistence and Defense Impairmenthttps://feed.craftedsignal.io/briefs/2026-10-defendnot-scheduled-task/Mon, 19 Oct 2026 08:54:06 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-defendnot-scheduled-task/The Defendnot hacktool utilizes a custom scheduled task for persistence and abuses the Windows Security Center API to register itself as a fake antivirus product to disable Windows Defender.Defendnot is a hacktool designed to facilitate the impairment of Windows Defender by abusing undocumented Windows Security Center (WSC) APIs. By masquerading as an installed antivirus security provider, the tool tricks the operating system into disabling the legitimate Windows Defender service. This capability significantly lowers the security posture of compromised hosts. To maintain its foothold, the tool utilizes a persistent scheduled task configuration. Security operations teams should prioritize monitoring for the creation of this specific scheduled task, as it serves as a reliable indicator of Defendnot deployment and potential unauthorized security configuration changes on Windows endpoints.

Attack Chain

  1. An attacker gains initial access to a Windows system and drops the Defendnot binary.
  2. The binary executes and invokes undocumented WSC APIs to register itself as a security provider.
  3. The registration process identifies the tool as an active antivirus engine, prompting Windows to disable Windows Defender.
  4. The tool executes a schtasks command or API call to create a scheduled task named 'defendnot'.
  5. The scheduled task is configured with the argument '--from-autorun' to ensure persistence across reboots.
  6. The system schedules the task to run the binary repeatedly, ensuring the malicious security provider registration remains active.
  7. Windows Defender remains incapacitated, allowing subsequent stages of the attack or unauthorized activity to proceed without interference.

Impact

Successful execution of Defendnot leads to the disabling of Windows Defender, leaving the affected system vulnerable to further exploitation, malware infection, and data exfiltration. The tool directly impairs the host's primary defense-in-depth mechanism. While specific victim counts are not reported, this tool is categorized as a high-risk security impairment utility suitable for post-exploitation persistence and stealth.

Recommendation

  • Deploy the provided Sigma rule to detect the creation of the 'defendnot' scheduled task via Security event logs (EID 4698/4702).
  • Use EDR or forensic tooling to hunt for the presence of the 'defendnot' binary and any associated task registrations.
  • Audit security provider registrations using the Windows Security Center API to identify unauthorized or rogue antivirus entries.
  • Block the execution of unsigned or unrecognized security-related utilities that interact with the WSC service.
]]>highadvisoryhacktoolpersistencedefense-impairmentsecurity-centerwindows