This rule detects a specific PowerShell attack technique used by the Defendnot tool, which installs via a one-liner that downloads and executes a remote script. The detection looks for PS script blocks containing a remote URL (https://dnot.sh/) and a pattern that includes both a local path segment (/defendnot) and a reference to GitHub, indicating the download and execution of the Defendnot script. Defendnot abuses the Windows Security Center (WSC) API to masquerade as antivirus software and disable Windows Defender, representing a defense-impairment objective. The rule focuses on Windows PowerShell script activity that fetches and runs external code related to Defendnot, with a high-severity posture given the potential impact on endpoint defense. False positives are considered unlikely due to the specificity of the URL and combined path indicators, though legitimate software download and scripting utilities could occasionally resemble similar patterns. This rule is aimed at detecting initial installation or setup activity during an attacker’s attempt to deploy Defendnot on a Windows host.