Pipeline Stage 12

MAPS Cloud Lookup

Microsoft Active Protection Service — cloud-delivered detection

fastpath.wdcpCloud Endpoint
BondSerialization
4FASTPATH Sig Types
72STREAM_ATTRIBUTEs

fastpath.wdcp.microsoft.com @ 0x10A09EC0 — BondSerializer @ 0x109C80E0

Cloud Pipeline Flow

Lowfi match triggers report generation, Bond serialization, and HTTPS POST

Lowfi Detection from Stages 3-11
"lowfi" @ 0x109C60D0 — not confident enough for local verdict
↓
Build SpynetReport
"SpynetReport" @ 0x109C9E00 — hashes, metadata, attributes, certs
↓
Bond CompactBinaryV1 Serialize
CompactBinaryV1Serializer @ 0x10C823C4
↓
HTTPS POST to MAPS endpoint (fastpath.wdcp.microsoft.com in this build)
@ 0x10A09EC0 — via MpCommu.dll transport
↓
Parse FASTPATH Response: SDN / TDN / DATA
Cloud delivers real-time signatures

SpynetReport Contents

What gets sent to the cloud: file metadata, hashes, detection info, and scan context

File Hashes SHA-256, SHA-1, MD5 of scanned content
File Metadata Size, path, content type, creation time
Certificate Chain Digital signature and publisher info
Lowfi Detection Detection name, threat ID, sig sequence
Scan Attributes All attributes from Stages 3-11
Machine Context Machine GUID, OS version, SpynetReportGuid

Bond Data Classes

Bond_SpynetReport @ 0x10C831AC Bond_SignatureInfo @ 0x10C8240C Bond_SignatureMatch @ 0x10C824AC Bond_CertificateResult @ 0x10C824D0 Bond_SampleRequest @ 0x10C824F8 Bond_SpynetReportResponse @ 0x10C8253C Bond_UrlResponse @ 0x10C8251C

FASTPATH Response Signatures

The cloud delivers real-time signatures that upgrade or drop local detections

FASTPATH_SDN

SIGNATURE_TYPE_FASTPATH_SDN @ 0x109869AC

Signature Delivery Notification — cloud delivers a detection name to apply. Upgrades lowfi to full detection.

"Issuing SDN query for %ls (%ls)" @ 0x10A53D68

FASTPATH_SDN_EX

SIGNATURE_TYPE_FASTPATH_SDN_EX @ 0x10986110

Extended SDN — includes additional metadata beyond detection name (confidence, context).

FASTPATH_TDN

SIGNATURE_TYPE_FASTPATH_TDN @ 0x1098647C

Threat Delivery Notification — cloud delivers threat identity. Can match or DROP local detections.

"SDN/TDN matched, dropped detection" @ 0x10A53EB0

FASTPATH_DATA

SIGNATURE_TYPE_FASTPATH_DATA @ 0x1098691C

Binary Signature Data — cloud delivers entire signature rules for local matching. Real-time sig delivery.

Latency Telemetry

20+ telemetry fields track every phase of the cloud request lifecycle

Generate
→
DNS
→
Connect
→
Send
→
Receive
→
Parse
// MAPS latency telemetry fields MAPSClientLatency @ 0x109D1D4C MAPSGenerateLatency @ 0x109D1D70 MAPSSendLatency @ 0x109D1D98 MAPSParseLatency @ 0x109D1DB8 MAPSHresult @ 0x109D1DDC MAPSHttpStatus @ 0x109D1DF4 MAPSCreateConnectionTime @ 0x109D1E34 MAPSSendRequestTime @ 0x109D1E68 MAPSReceiveResponseTime @ 0x109D1EE4 MAPSOnResolvingNameTick @ 0x109D1F3C MAPSOnConnectedTick @ 0x109D1FC8 MAPSOnFirstSendingTick @ 0x109D1FF0 MAPSOnFirstReceivingTick @ 0x109D2020 LastMAPSSuccessTime @ 0x109D24C0 LastMAPSFailureTime @ 0x109D24E8

SpyNet Configuration

MAPS behavior controlled by SpyNet reporting level and registry settings

Cloud Block Levels

0 Off No cloud queries (MAPSOff @ 0x10A08980)
1 Moderate Minimal metadata for lowfi lookups
2 High Full metadata + file samples when requested
3 High+ Enhanced heuristics + automatic sample submission
4 Zero Tolerance Block all unknown files pending cloud verdict
// Registry paths SOFTWARE\Microsoft\Windows Defender\Spynet @ 0x109C6D28 SOFTWARE\Microsoft\Microsoft Antimalware\Spynet @ 0x109C6CC8

Configuration Parameters

MpMaxSpynetReports @ 0x10A4EDF4 Max concurrent reports in-flight MpDisableSyncSpynetCheck @ 0x10A0875C Disable synchronous check fastpathcachesize @ 0x109F2A34 FASTPATH response cache size MP_FASTPATH_LOWFI_LIFETIME @ 0x1098C998 Cache TTL for lowfi responses SpynetBondKillbit @ 0x10A4EF70 Bond killbit flag

Network Architecture

mpengine.dll builds the report; MpCommu.dll handles HTTP transport

mpengine.dll
Build SpynetReport → Bond serialize → CompactBinaryV1 blob
↓
MpCommu.dll
TLS/HTTPS → Certificate pinning → Connection pooling → Retry logic
↓
fastpath.wdcp.microsoft.com
ML models + reputation + prevalence + dynamic sandboxing correlation
Production fastpath.wdcp.microsoft.com
@ 0x10A09EC0
PPE fastpath.wdcpppe.microsoft.com
@ 0x10A09EF8
PPE Alt fastpath.wdcpppe.microsoft-ppe.com
@ 0x10A09E48

Error Handling & Resilience

Graceful degradation when the cloud is unreachable

Network Failure Record LastMAPSFailureTime. Keep lowfi as-is. Do NOT upgrade to full.
Deser Failure "BondDeserializationFailure" @ 0x109D9A70. Drop response, keep lowfi.
MAPS Disabled "MAPSOff" @ 0x10A08980. Skip entire Stage 12.
Cache Hit "Defender_Engine_CachedSDN" @ 0x10A53BA8. Apply cached response.
Success Record LastMAPSSuccessTime @ 0x109D24C0. Apply FASTPATH sigs.

Detection State Machine

// Detection upgrade/suppression strings "BM detection upgraded to threat detection." @ 0x10A66498 "BM detection NOT upgraded to threat detection." @ 0x10A664F0 "BM detection suppressed due to friendlyness." [sic] @ 0x10A666C0 "SDN recieved [sic], rescanning impacted resources" @ 0x10A53E40

Key Takeaways

5 Cloud Block Levels

Off / Moderate / High / High+ / Zero Tolerance. Controls detection aggressiveness.

7 Report Types

Async Lowfi, Sync Lowfi, Telemetry, Sample, Heartbeat, URL Reputation, WDO.

Certificate Pinning

SSLOptions 0-3: SHA-1 root thumbs + SHA-256 SPKI public key hashes. CRL via AME root CAs.

4 FASTPATH Sig Types

SDN (name), SDN_EX (extended), TDN (threat identity), DATA (binary sigs). Real-time delivery.

72 STREAM_ATTRIBUTEs

Including 8 AMSI-specific. URL, Threat ID, LOFI, MOTW ADS, Trust Level, Session/App IDs.

Graceful Degradation

Network failures do not cause false positives. Cached FASTPATH responses. 20+ latency metrics.

All data from reverse engineering mpengine.dll v1.1.24120.x