This rule detects the default scheduled task activity used by the hacktool Defendnot to persist and disable Windows Defender. It watches Windows Security events for task scheduler activity (Event IDs 4698 and 4702) and flags when a scheduled task named '\defendnot' is created or updated and its TaskContent contains the 'defendnot' identifier with the argument '--from-autorun' in its XML payload. Defendnot purportedly registers itself via Microsoft’s WSC API as a fake antivirus product; the creation of this task with the --from-autorun parameter is a persistence mechanism to ensure the fake AV remains active. The rule therefore targets a high-severity persistence/defense-impairment technique (MITRE T1053.005). It is designed to minimize false positives by requiring both the TaskName match and the presence of the specific argument payload. As with any heuristic around scheduled tasks, legitimate admin activity could resemble this pattern; correlation with additional signals (e.g., process launches, WSC API usage, sign-in context) improves confidence.