# Detecting Malicious Security Product Bypass Techniques

defendnot abuses undocumented Windows Security Center IWscAvStatus COM APIs from injected Taskmgr.exe to register a fake AV, forcing Windows Defender into a disabled state.

- Payout: Research
- Severity: high
- Program: Windows Defender
- Credited: Huntress
- Disclosed: 2025-05-23
- Write-up quality: 7/10
- Original: https://www.huntress.com/blog/defendnot-detecting-malicious-security-product-bypass-techniques
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-defendnot-detecting-malicious-security-product-bypass-techniques
- Tags: domain:desktop impact:integrity kind:research platform:threat-intel sev:high tech:windows technique:reverse-engineering technique:source-review vuln:auth-bypass vuln:misconfiguration vuln:privilege-escalation

**Target:** Windows Security Center IWscAvStatus COM interface / Taskmgr.exe
**Root cause:** Undocumented WSC COM interfaces (IWscAvStatus Register/UpdateStatus) intended only for NDA-bound AV vendors can be invoked from an injected trusted process that passes WSC signature validation, letting any code register a fake AV and force Defender off.
**Steps:**
1. Run `defendnot-loader.exe`; it parses args and writes `ctx.bin` config.
2. Loader injects `defendnot.dll` into `taskmgr.exe` (hardcoded kVictimProcess) via OpenProcess/WriteProcessMemory/CreateRemoteThread.
3. Injected DLL calls IWscAvStatus `Register` to register the fake AV product.
4. Calls `UpdateStatus` to mark the fake AV active in WSC.
5. WSC writes AV registry keys and Defender transitions to disabled state.
6. Optional: create autorun scheduled task for persistence across reboots.
**How found:** es3n1n reverse-engineered WSC COM methods and the signature validation checks, enumerating binaries that would pass validation and selecting Taskmgr.exe as injection target.
**Exploitation:** Attacker with local execution runs the loader, which injects into Taskmgr.exe to satisfy WSC signature checks, registers a fabricated AV via IWscAvStatus, and activates it, causing Defender to disable itself and enabling follow-on malware.
**Escalation:** Optional persistence via scheduled task/registry autorun keeps the fake AV registered across reboots, maintaining Defender disabled.
**Insight:** Security-product registration APIs (WSC IWscAvStatus) trust the calling process's signature, not the payload — injecting into a signed binary that passes vendor validation lets you register a fake AV and force Defender off; hunt for unexpected modules in Taskmgr.exe and WSC AV registry writes.