Loading malware…
Defender Control is a utility used by threat actors for defense evasion by disabling Microsoft Defender. In the provided reporting, Elastic observed Cuba ransomware-associated operators using DefenderControl.exe to disable Microsoft Defender and using svchost.exe to create a scheduled task to keep it running during intrusions affecting North American and European retailers and manufacturers. ASEC also reported Trigona threat actor activity against publicly exposed or weakly protected MS-SQL servers in which the actor used Defender Control alongside other privilege-related tools sourced from GitHub. High-confidence behavior directly described in the content is limited to disabling Microsoft Defender; the content also notes that other privilege escalation tools are available in Defender Control and GitHub, but does not attribute specific additional capabilities to this malware with certainty. Associated activity in the cited campaigns included ransomware operations, remote administration tooling, credential theft, lateral movement, and persistence, but Defender Control’s directly stated role was defense evasion.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
the threat actors used Defender Control as a way to disable Microsoft Defender
5 distinct techniques documented for this family, organized by ATT&CK tactic.
Defender Control sets a couple registry values to disable Defender including this one: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware DWORD (0x00000001) Defender Control also sets this value to disable the startup of the Defender service: HKLM\System\CurrentControlSet\Services\WinDefend\Start DWORD (0x00000003)
Defender Control sets a couple registry values to disable Defender including this one: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware DWORD (0x00000001) Defender Control also sets this value to disable the startup of the Defender service: HKLM\System\CurrentControlSet\Services\WinDefend\Start DWORD (0x00000003)
7 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Tool referenced as used/available to the actor to weaken or disable Microsoft Defender protections as part of post-compromise activity.
Tool used to disable Microsoft Defender to evade detection; persistence maintained via scheduled task execution.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.