New ‘Defendnot’ tool tricks Windows into disabling Microsoft Defender

Source: BleepingComputer

Author: Lawrence Abrams

URL: https://www.bleepingcomputer.com/news/microsoft/new-defendnot-tool-tricks-windows-into-disabling-microsoft-defender/

  1. ONE SENTENCE SUMMARY: The Defendnot tool exploits an undocumented Windows API to disable Microsoft Defender by registering a fake antivirus product.

  2. MAIN POINTS:

  3. Defendnot disables Microsoft Defender by registering a fake antivirus using Windows Security Center API.

  4. Windows disables Defender automatically when another antivirus registers to prevent security conflicts.

  5. Researcher es3n1n developed Defendnot based on an earlier project called no-defender.

  6. The earlier no-defender tool was removed from GitHub due to a DMCA copyright claim.

  7. Defendnot avoids legal issues by using a self-built dummy antivirus DLL rather than third-party code.

  8. Protected Process Light (PPL) and digital signatures normally safeguard the WSC API.

  9. Defendnot bypasses security by injecting its DLL into the trusted Microsoft-signed Taskmgr.exe process.

  10. The tool supports configuration via ctx.bin file, custom antivirus names, and verbose logging.

  11. Defendnot achieves persistence by creating an autorun entry in Windows Task Scheduler.

  12. Microsoft Defender identifies and quarantines Defendnot as ‘Win32/Sabsik.FL.!ml’.

  13. TAKEAWAYS:

  14. Windows Security Center API can be manipulated to disable built-in security defenses.

  15. Trusted processes like Task Manager can be exploited to bypass Windows security protections.

  16. Persistence mechanisms via Task Scheduler highlight the importance of monitoring scheduled tasks.

  17. Microsoft Defender actively detects and blocks Defendnot, signaling ongoing defender capabilities.

  18. Security teams should be aware of undocumented APIs and regularly audit registered antivirus products.