sync/es3n1n-defendnot
1
0
Fork 0
mirror of https://github.com/es3n1n/defendnot.git synced 2026-08-02 10:32:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs(readme): add installation tip

Browse Source
This commit is contained in:
es3n1n
2025-05-27 13:33:57 +02:00
parent 0ced917255
commit 0b394f3457
1 changed files with 14 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
README.md
View File

@@ -6,7 +6,7 @@ Defendnot is a successor of [no-defender](https://github.com/es3n1n/no-defender)
![](https://i.imgur.com/epX8wkd.jpeg) ![](https://i.imgur.com/epX8wkd.jpeg)
> [!WARNING] > [!CAUTION]
> **Permitted Use Notice**: > **Permitted Use Notice**:
> >
> Using this tool to facilitate malware distribution, cybercrime, unauthorized access, evading detection, or any illegal activity is strictly prohibited. > Using this tool to facilitate malware distribution, cybercrime, unauthorized access, evading detection, or any illegal activity is strictly prohibited.
@@ -17,6 +17,9 @@ Defendnot is a successor of [no-defender](https://github.com/es3n1n/no-defender)
## Installation ## Installation
> [!TIP]
> You may need to temporarily disable realtime and tamper protection before proceeding, otherwise defender will block `defendnot` binaries due to the `VirTool:Win64/Defnot.A` detection.
### One-liner ### One-liner
Open the powershell as administrator and execute any of these: Open the powershell as administrator and execute any of these:
@@ -63,11 +66,18 @@ Optional arguments:
There's a WSC (Windows Security Center) service in Windows which is used by antiviruses to let Windows know that there's some other antivirus in the hood and it should disable Windows Defender. There's a WSC (Windows Security Center) service in Windows which is used by antiviruses to let Windows know that there's some other antivirus in the hood and it should disable Windows Defender.
This WSC API is undocumented and furthermore requires people to sign an NDA with Microsoft to get its documentation. This WSC API is undocumented and furthermore requires people to sign an NDA with Microsoft to get its documentation.
The initial implementation of [no-defender](https://github.com/es3n1n/no-defender) used thirdparty code provided by other AVs to register itself in the WSC, while defendnot interacts with WSC directly. The initial implementation of [no-defender](https://github.com/es3n1n/no-defender) used thirdparty code provided by other AVs to register itself in the WSC, while `defendnot` interacts with WSC directly.
## Limitations ## Limitations
Sadly, to keep this WSC stuff even after reboot, defendnot adds itself to the autorun. Thus, you would need to keep the defendnot binaries on your disk :( - **Needs to stay on disk:**
To keep the AV registration persistent after reboot, `defendnot` adds itself to autorun. That means the binaries have to remain on your system for the Defender "disable" to stick. (Yeah, I wish it were more elegant too.)
- **No support for Windows Server:**
The Windows Security Center (WSC) service doesn’t exist on Windows Server editions, so `defendnot` *won’t* work there. See [#17](https://github.com/es3n1n/defendnot/issues/17).
- **Defender Detection:**
Not surprisingly, Windows Defender really doesn’t like `defendnot` and will flag or remove it as `VirTool:Win64/Defnot.A`. You’ll need to (temporarily) disable Defender’s real-time and tamper protection to install.
## Legitimate Use Cases ## Legitimate Use Cases
@@ -76,7 +86,7 @@ Sadly, to keep this WSC stuff even after reboot, defendnot adds itself to the au
- Educational research on Windows security mechanisms - Educational research on Windows security mechanisms
- Home lab experimentation and learning - Home lab experimentation and learning
> [!WARNING] > [!IMPORTANT]
> If your intended usage falls outside these legitimate use cases, support in issues/DMs might be denied without any further explanations. > If your intended usage falls outside these legitimate use cases, support in issues/DMs might be denied without any further explanations.
## Writeup ## Writeup