DefendNot: Disabling Windows Defender the Unofficial Way

Why This Is Interesting

Windows Defender is great at keeping your system safe—until it gets in the way of legitimate testing, development, or performance tuning. Most "disable Defender" guides involve registry tweaks or PowerShell commands, but DefendNot takes a different (and frankly, funnier) approach: it tricks Windows into thinking another antivirus is installed by abusing the undocumented Windows Security Center (WSC) API.

It’s a clever hack, but it also highlights how Windows security internals work—or sometimes, don’t.

What It Does

DefendNot registers itself as a "legitimate" antivirus with the WSC service, forcing Windows Defender to stand down. Unlike older methods (e.g., registry edits), this approach is more persistent and doesn’t require disabling Defender manually every reboot.

Key features:

• No manual Defender tweaking – Windows thinks another AV is active.
• Persistence – Stays active after reboots (via autorun).
• Customizable – You can set a fake AV name (default: dnot.sh).

Why It’s Cool

1. Undocumented API Shenanigans
   The WSC API isn’t public—Microsoft requires an NDA to access its docs. DefendNot reverse-engineered it, which is a neat technical feat.

2. Legitimate Use Cases

   • Testing environments – Disable Defender temporarily for malware analysis (without fully neutering security).
   • Performance tuning – Reduce Defender’s CPU/memory usage during heavy workloads.
   • Research – Learn how Windows handles AV conflicts.

3. It’s Open-Source
   The code is available for scrutiny (and learning).

How to Try It

Quick Install (PowerShell Admin)

irm https://dnot.sh/ | iex

Or, with a custom AV name:

& ([ScriptBlock]::Create((irm https://dnot.sh/))) --name "TotallyLegitAV"

Manual Install

1. Grab the latest release.
2. Extract and run defendnot-loader.exe.

Note: Defender will flag this as VirTool:Win64/Defnot.A—temporarily disable real-time protection first.

Limitations

• Requires persistence – Files must stay on disk (autorun task).
• No Server Support – WSC doesn’t exist on Windows Server editions.
• Defender hates it – You’ll need to whitelist/disable Defender temporarily.

Final Thoughts

DefendNot is a clever (if slightly janky) way to sidestep Windows Defender. It’s not for malware—it’s for developers, researchers, and tinkerers who need fine-grained control over their security setup.

If you’re curious about Windows internals, check out the accompanying writeup on reverse-engineering WSC. And remember: use responsibly—this isn’t a tool for bypassing security, just understanding it.

🔗 GitHub: es3n1n/defendnot