Defender Control

Defender Control is a utility used by threat actors for defense evasion by disabling Microsoft Defender. In the provided reporting, Elastic observed Cuba ransomware-associated operators using DefenderControl.exe to disable Microsoft Defender and using svchost.exe to create a scheduled task to keep it running during intrusions affecting North American and European retailers and manufacturers. ASEC also reported Trigona threat actor activity against publicly exposed or weakly protected MS-SQL servers in which the actor used Defender Control alongside other privilege-related tools sourced from GitHub. High-confidence behavior directly described in the content is limited to disabling Microsoft Defender; the content also notes that other privilege escalation tools are available in Defender Control and GitHub, but does not attribute specific additional capabilities to this malware with certainty. Associated activity in the cited campaigns included ransomware operations, remote administration tooling, credential theft, lateral movement, and persistence, but Defender Control’s directly stated role was defense evasion.