Pipeline Stage 13 — Final Stage

Verdict Resolution

Merge all detections → filter → rank → deliver final answer

5Severity Levels

20+Threat Categories

4Suppression Checks

0Verdict Fields

threatmgr @ 0x109C7E58 — the final arbiter of all scan results

Resolution Pipeline

Five steps from raw detection list to final user-facing verdict

1. Merge — Collect all ThreatRecords from Stages 3-12
Static + emulation + Lua + AAGGREGATOR + MAPS FASTPATH

↓

2. Filter Infrastructure Markers — Remove all !-prefixed names
AAGGREGATOR building blocks are never reported to users

↓

3. Apply Suppressions — Exclusions, friendly files, cache, lowfi drops
"BM detection suppressed due to..." @ 0x10A666C0+

↓

4. Deduplicate & Rank — Highest severity wins: 5 > 4 > 2 > 1
Cloud results supersede local lowfi

↓

5. Final Verdict — Threat name + severity + category + action
Returned to MpSvc / AMSI client / scan API caller

Severity Hierarchy

The highest severity detection wins — "threatseverity" @ 0x109DA50C

5 SEVERE Worms, ransomware,
rootkits

4 HIGH Trojans, backdoors,
exploits

3 (unused) Gap in the
severity scale

2 MEDIUM Spyware, browser
modifiers

1 LOW Adware, PUA,
may be intentional

When multiple detections exist, the one with the highest severity becomes the final verdict. The severity scale has no level 3 — it jumps from Medium (2) to High (4).

Infrastructure Marker Filtering

!-prefixed threat names from AAGGREGATOR are building blocks — never shown to users

Before Filtering

# Raw threat_list from all stages

1. !SuspiciousImportTable     infra
2. !HighEntropyText           infra
3. !NotSignedByTrustedPub     infra
4. Trojan:Win32/AgentTesla.RPX!MTB
                               severity: 4
5. !PESmallFile               infra
6. TrojanDownloader:Win32/AgentTesla.DA
                               severity: 4

After Filtering

# Infrastructure markers removed

4. Trojan:Win32/AgentTesla.RPX!MTB
   severity: 4 (High)

6. TrojanDownloader:Win32/AgentTesla.DA
   severity: 4 (High)

# Winner (first with highest severity):
→ Trojan:Win32/AgentTesla.RPX!MTB

4 infra markers filtered, 2 real threats remain Only real detections reach the user

Suppression Pipeline

Four suppression checks applied before finalizing the verdict

Exclusion Check

"BM detection suppressed due to exclusion."

@ 0x10A66880 — excludedthreats @ 0x109E4380

Friendly File Check

"BM detection suppressed due to friendlyness." [sic]

@ 0x10A666C0 — trusted publisher list

Cache Check

"BM detection suppressed due to cache."

@ 0x10A668F0 — previous scan result cached

Lowfi Suppression

"Lowfi detection supressed [sic]"

@ 0x10A536B0 — cloud says clean or named attribute filter

Threat Name Anatomy

Standardized naming convention: Category:Platform/Family.Variant!Suffix

Trojan:Win32/AgentTesla.RPX!MTB
  ↑       ↑      ↑          ↑    ↑
  Category Platform  Family    Variant Suffix

Category Trojan, Virus, Ransom, PUA, HackTool, Backdoor, Exploit...

Platform Win32, Win64, MSIL, JS, VBS, Linux, MacOS, AndroidOS...

Family Malware family identifier (e.g., Emotet, WannaCrypt, Cobalt)

Variant Specific variant: letter (A-Z), then RPX, DA, etc.

Detection Suffixes

!MTB

SIG_TREE 0x40 — PE boolean attribute decision trees

Local

!ml

SIG_TREE_EXT 0x41 + SIG_TREE_BM 0xB3 — string-matching trees

Local

!atmn

Original threat name suffix from VDM (not engine-generated)

Local (VDM)

!dha

Dynamic Heuristic Analysis (PE emulation + Lua)

Local

!pz

Pattern-based heuristic

Local

!cl

Cloud-delivered ML classification via MAPS

Cloud (MAPS)

!rfn

Real-time File Notification (reputation) via MAPS

Cloud (MAPS)

(none)

Traditional signature match (exact byte-pattern)

Local

Verdict Data Structure

The final output returned to the scan caller

struct ScanVerdict {
  // Primary result
  threat_id:         u32,   // @ 0x109DA464
  threat_id_ex:      u32,   // @ 0x109E68EC
  original_threat_id:u32,   // @ 0x109E7A2C
  threat_name:       &str,  // @ 0x109D44AC
  detection_name:    &str,  // @ 0x109DD874

  // Classification
  severity:          u8,    // @ 0x109DA50C
  category:          u8,    // @ 0x109DA478
  threat_level:      u8,    // @ 0x109E4380

  // Recommended action
  threat_advice:     &str,  // @ 0x109DA554
  advice_info_id:    u32,   // @ 0x109DA5EC

  // Tracking
  tracking_id:       GUID,  // @ 0x109D3DD0
  consolidated_ids:  &str,  // @ 0x109D3E20
}

Recommended Actions

Remove Severity >= 4 (High/Severe) — delete file

Quarantine Severity >= 2 (Medium+) — move to quarantine

Allow User override or PUA audit mode

Clean Virus infection — remove malicious code, preserve file

Detection Upgrade Paths

Detections can be upgraded, dropped, or consolidated during resolution

BM Upgrade

BM lowfi backed by threat detection → upgraded to full threat

"BM detection upgraded to
 threat detection."
@ 0x10A66498

Cloud Upgrade

MAPS FASTPATH SDN delivers full detection name to replace local lowfi

"SDN recieved [sic], rescanning
 impacted resources"
@ 0x10A53E40

Cloud Drop

Cloud says clean → SDN/TDN matched, detection dropped entirely

"SDN/TDN matched, dropped
 detection for %ls"
@ 0x10A53EB0

Complete Pipeline: Start to Verdict

All 13 stages converging into a single definitive answer

Entry

→

FRIENDLY

→

Static

→

Attr

→

Emu

→

Unpack

→

Containers

→

Deob

→

BRUTE

→

Lua

→

AAGG

→

MAPS

→

VERDICT

threatname@ 0x109D44AC

threatseverity@ 0x109DA50C

threatcategory@ 0x109DA478

threatadvice@ 0x109DA554

Key Takeaways

Highest Severity Wins

Multiple detections merged. Severity ranking: Severe(5) > High(4) > Medium(2) > Low(1). No level 3.

Infra Markers Filtered

!-prefixed AAGGREGATOR building blocks are permanently removed. Users only see real threat names.

Four Suppression Layers

Exclusions, friendly file check, scan cache, and cloud-directed lowfi drops all reduce false positives.

Cloud Can Override

FASTPATH SDN/TDN from MAPS can upgrade lowfi to full detection or drop false positives entirely.

All data from reverse engineering mpengine.dll v1.1.24120.x