A new tool called 'Defendnot' can disable Microsoft Defender on Windows devices by registering a fake antivirus product, even when no real AV is installed.

In a proof-of-concept, a security researcher demonstrated how the Windows Security Center API can be used to block the scans by Microsoft’s built-in antivirus tool.