diff --git a/data/yara/CAPE/Defendnot.yar b/data/yara/CAPE/Defendnot.yar
new file mode 100644
index 00000000000..311cc56d7a5
--- /dev/null
+++ b/data/yara/CAPE/Defendnot.yar
@@ -0,0 +1,15 @@
+rule Defendnot
+{
+    meta:
+        author = "kevoreilly"
+        description = "Defendnot Payload"
+        cape_type = "Defendnot Payload"
+        hash = "b0870e105c7ad37fb0bdcb9305279b2943810d55300e8721eb64bdaa588cc84e"
+    strings:
+        $string1 = "defendnot"
+        $string2 = "Got HRESULT={:#x} at\n{}:{}"
+        $string3 = "init: {:#x}"
+        $string4 = "AV Name can not be empty!"
+    condition:
+        uint16(0) == 0x5a4d and all of them
+}
diff --git a/web/apiv2/test_visibility.py b/web/apiv2/test_visibility.py
index 67448dee390..b9d3966ac86 100644
--- a/web/apiv2/test_visibility.py
+++ b/web/apiv2/test_visibility.py
@@ -1580,7 +1580,7 @@ def test_task_x_hours_mt_off_uses_reversed_bounds_and_tuple_unpack(cape_db, monk
     _install_datetime_shim(monkeypatch, views, rec)
     d1 = _dt.datetime(2026, 1, 1, 12, 0, 0)
     # upstream shape: rows are (date, samples) tuples
-    monkeypatch.setattr(views.db, "Session",
+    monkeypatch.setattr(views.db, "session",
                         lambda *a, **k: _FakeSession(rec, [(d1, 3)]), raising=False)
 
     u = User.objects.create_user("txh_off", "txh_off@x.com", "x")
@@ -1613,7 +1613,7 @@ def test_task_x_hours_mt_off_tuple_unpack_rejects_plain_task(cape_db, monkeypatc
     class _NotATuple:
         added_on = None  # single object, NOT iterable into (date, samples)
 
-    monkeypatch.setattr(views.db, "Session",
+    monkeypatch.setattr(views.db, "session",
                         lambda *a, **k: _FakeSession(rec, [_NotATuple()]), raising=False)
 
     u = User.objects.create_user("txh_off2", "txh_off2@x.com", "x")
@@ -1644,7 +1644,7 @@ def __init__(self, tid, view):
             self.added_on = _dt.datetime(2026, 1, 1, 12, 0, 0)
 
     rows = [_T(1, True), _T(2, False), _T(3, True)]
-    monkeypatch.setattr(views.db, "Session",
+    monkeypatch.setattr(views.db, "session",
                         lambda *a, **k: _FakeSession(rec, rows), raising=False)
     monkeypatch.setattr(views, "can_view_task",
                         lambda user, t: t._view, raising=False)
diff --git a/web/apiv2/views.py b/web/apiv2/views.py
index 06aaccd9aef..ec500c34bc8 100644
--- a/web/apiv2/views.py
+++ b/web/apiv2/views.py
@@ -3168,7 +3168,7 @@ def cuckoo_status(request):
 @csrf_exempt
 @api_view(["GET"])
 def task_x_hours(request):
-    session = db.Session()
+    session = db.session()
     if not multitenancy_config().enabled:
         # Multitenancy disabled: reproduce upstream verbatim, including the
         # pre-existing reversed between() args (now, now-1day) that make this