MAPS in Windows Defender

How MAPS integrates with Microsoft Defender Antivirus — the cloud brain behind endpoint protection

What is MAPS in the Defender Pipeline?

MAPS (Microsoft Advanced Protection Service, formerly "SpyNet") is the cloud protection backend for Microsoft Defender Antivirus. It's not a separate product — it's the cloud component that every Defender installation communicates with to deliver real-time verdicts on suspicious files, URLs, and behaviors. When cloud protection is enabled (the default), Defender queries MAPS before allowing unknown executables to run.

Defender Features Powered by MAPS

MAPS Data Flow in Real-Time Protection

Key stat: With cloud protection enabled (Windows 10 E5), emergency dynamic intelligence updates can deliver fixes for malware within minutes instead of waiting for the next scheduled definition update. Microsoft recommends keeping cloud protection always on.

Architecture Overview

End-to-end system architecture from client to cloud

Key DLLs (Reverse-Engineered)

Bond CompactBinaryV1 Wire Format

Microsoft's binary serialization protocol — the wire format of all MAPS traffic

Field Header Encoding

┌─────────┬──────────┐
│ 7  6  5 │ 4 3 2 1 0│    1 byte field header
├─────────┼──────────┤
│  delta  │ bond_type│
└─────────┴──────────┘

delta 1-5:  field_id = previous_id + delta        (inline)
delta 6:    field_id = next_byte                   (uint8 absolute)
delta 7:    field_id = next_two_bytes              (uint16 LE absolute)

19 Bond Data Types

Varint Encoding

Value 300 (0x12C):
  Byte 1: 0xAC  = 0b_1_0101100  (continuation + low 7 bits: 44)
  Byte 2: 0x02  = 0b_0_0000010  (final + high bits: 2)
  Result: (2 << 7) | 44 = 256 + 44 = 300 ✓

Bonded<T> Envelope

The outer wrapper that encapsulates all MAPS payloads

Structure

43 42 01 00                    ← CB marshal header ("CB" + version 1)
Outer Struct {
  F5: STRING = schema_name     ← "Microsoft.ProtectionServices.Entities.Raw.SpynetReportEntity"
  BT_STOP_BASE                ← Base class terminator #1
  BT_STOP_BASE                ← Base class terminator #2 (resets field counter)
  F10: LIST<LIST<INT8>> = [[]] ← Runtime type info (empty)
  F20: STRUCT {                  ← Inner payload wrapper
    F5: STRING = schema_name   ← Schema name repeated
    BT_STOP_BASE              ← Base class terminator #1
    BT_STOP_BASE              ← Base class terminator #2
    [SpynetReport fields...]   ← Actual payload data
  BT_STOP                       ← End inner struct
}
BT_STOP                         ← End outer struct

Key Schema Name

Microsoft.ProtectionServices.Entities.Raw.SpynetReportEntity

This schema name is mandatory. The server validates it and returns HTTP 500 for unrecognized schemas.

Binary Example (Heartbeat)

43 42 01 00                     ← "CB\x01\x00" marshal header
A9 3D 4D 69 63 72 6F ...       ← F5 STRING: schema name (61 bytes)
01                              ← BT_STOP_BASE
01                              ← BT_STOP_BASE
CB 0B 0E 01 00                  ← F10: LIST<LIST<INT8>> = [[]]
EA 3D 4D 69 63 72 6F ...       ← F20.F5 STRING: schema name again
01 01                           ← Two more BT_STOP_BASE
[payload fields...]             ← SpynetReport Bond fields
00                              ← BT_STOP (inner)
00                              ← BT_STOP (outer)

HTTP Transport Layer

HTTPS request/response format matching real Defender traffic

Request Headers

POST /wdcp.svc/bond/submitreport HTTP/1.1
Host: wdcp.microsoft.com
Content-Type: application/bond
Accept: application/bond
Accept-Charset: utf-8
User-Agent: MpCommunication
Connection: Keep-Alive
X-MS-MAPS-CUSTOMERTYPE: Consumer
X-MS-MAPS-OSVERSION: a0000000065f4
X-MS-MAPS-PLATFORMVERSION: 40012659a0005
X-MS-MAPS-ENGINEVERSION: 10001659a0001
Content-Length: <size>

Version Header Encoding

Versions are packed as 64-bit hex: (major<<48) | (minor<<32) | (build<<16) | revision

Authentication Modes

File Scan Flow

Complete request/response cycle for cloud file reputation

SpynetReport Payload Structure

SpynetReport {
  F20:  Revision = LIST<INT16>[3]       ← Schema version
  F30:  MachineGuid = STRING              ← Client identity (UUID4)
  F40:  AvSigVersion = STRING             ← "1.445.126.0"
  F60:  EngineVersion = STRING            ← "1.1.26010.1"
  F150: OsVer = STRING                    ← "10.0.0.0"
  F170: OsBuild = LIST<UINT32>[26100]
  F200: GeoId = LIST<INT32>[244]         ← US
  F300: AppVersion = STRING               ← "4.18.26010.5"
  F390: FileReportElements = LIST<LIST<STRUCT>> [
    FileReport {
      F10: Revision = LIST<INT16>[1]
      F20: Index = LIST<INT16>[1]
      F30: CoreReport = LIST<STRUCT> [{
        F20: FileName = "malware.exe"
        F30: FileSystem = "NTFS"
        F40: Size = LIST<INT64>[file_size]
        F80: MD5 = "44d88612fea..."
        F90: SHA1 = "3395856ce81..."
        F100: SHA256 = "275a021bbf..."
        F330: ReportType = "2"  ← SYNC_LOWFI
      }]
    }
  ]
  F1050: EngineReportGuid = STRING (UUID)
}

URL Reputation Flow

How Defender queries cloud for URL/domain safety ratings

UrlReport Structure (F1542)

UrlReport = LIST<STRUCT>[1] {   ← Must be LIST, not STRUCT (HTTP 500 otherwise!)
  F3:  UrlReportGuid = STRING (UUID)
  F6:  UrlList = STRUCT {
    F3: Urls = LIST<STRUCT> [
      UrlElement {
        F20: Url = "https://example.com"   ← Only field set by engine
        // F10: Order — NOT set by engine
        // F21: Url_Scrubbed — NOT set by engine
      }
    ]
  }
  F9:  UrlContext = STRUCT { ... }     ← Optional
  F12: SigSeq = "0"                    ← Mandatory
  F15: SigSha = ""                     ← Mandatory
  // F18: ReportOnly — omitted when querying
}

URL Response Fields

Heartbeat System

12 heartbeat subtypes for connectivity, telemetry, and lifecycle events

Report Type = 4 (HEARTBEAT)

Heartbeat is indicated by F90: IsHeartBeat = 1 in SpynetReport, plus F920/F930 subtype fields.

Heartbeat Bond Fields

F90:  IsHeartBeat = UINT8(1)           ← Flags this as heartbeat
F920: StillAliveHB = LIST<UINT8>[type] ← Heartbeat subtype (0-11)
F930: HBControlGroup = LIST<UINT8>[0]  ← A/B test group
F940: HBSubtype = UINT8                ← Additional subtype info
F290: Membership = "2"                 ← Report type string

Block at First Sight (BAFS)

Zero-tolerance cloud blocking for unknown files

Cloud Block Levels

Note: Values 3, 5, 7+ are not documented. The fuzzer probes these gaps for hidden behavior.

Sample Upload Flow

Cloud-triggered file upload to Azure Blob Storage for detonation

Upload Headers

PUT <blob_sas_uri> HTTP/1.1
Content-Type: application/octet-stream
x-ms-blob-type: BlockBlob
Content-Encoding: gzip              ← If compression requested
x-ms-meta-compression: gzip
Content-Length: <size>

Response Parsing

Decoding the Bond response from MAPS cloud

Response Schema

SubmitSpynetReportResult {
  F5: Schema = "Microsoft.ProtectionServices.Entities.Raw.SubmitSpynetReportResult"
  F6: SpynetReportResponse = LIST<STRUCT>[1] {
    F3:  Revision = UINT8(5)              ← Protocol version
    F6:  SampleRate = INT32(1)            ← Telemetry sampling
    F9:  SampleRequests = LIST<STRUCT>   ← Upload requests (if any)
    F12: SignaturePatches = LIST<STRUCT>  ← FASTPATH signatures!
    F15: UrlResponse = STRUCT             ← URL reputation result
    F18: ThreatDetailElements = LIST<STRUCT>
    F21: CertificateResponse = STRUCT
    F24: OnboardingResponse = STRUCT
  }
  F10: RuntimeType = STRUCT             ← Runtime type info
}

Verdict Logic

Response Sizes

FASTPATH Dynamic Signatures

VDM TLV format — real-time threat definitions delivered from cloud

TLV Entry Format

┌──────────┬──────────┬───────────┬──────────────────┐
│ type (1) │ size_lo  │ size_hi   │ payload (size)   │
│  1 byte  │  1 byte  │  2 bytes  │  variable        │
└──────────┴──────────┴───────────┴──────────────────┘
size = size_lo | (size_hi << 8)   ← 24-bit little-endian

Known Entry Types

EICAR Response Example (385 bytes)

[0xEC ENVELOPE]     256 bytes — Encrypted detection logic (RSA-2048 + AES)
[0xAA FASTPATH_DATA]  20 bytes — Compilation timestamp, config flags
[0x5C THREAT_BEGIN]   47 bytes — ThreatID=2147519003
                                    "Virus:DOS/EICAR_Test_File"
[0x67 STATIC]         38 bytes — SHA1 + MD5 + CRC32 of EICAR
[0x5D THREAT_END]      4 bytes — ThreatID=2147519003 (closing)

SpynetReport Schema

372 Bond fields reverse-engineered from mpengine.dll RTTI vtable analysis

Top-Level Fields (Key Selection)

Nested Schema Classes

All Endpoints & Authentication

Complete endpoint map with geo-affinity and failover

Primary Endpoints

Geo-Affinity Endpoints (Data Residency)

API Paths

Attack Surface & Fuzzing Targets

Where to look for hidden features, undocumented behavior, and security gaps

Fuzzer Modules (fuzz_maps.py)

High-Value Targets for Hidden Features

Running the Fuzzer

# Quick test — hidden feature probes
python fuzz_maps.py hidden

# Full sweep with proxy inspection
python fuzz_maps.py --proxy http://127.0.0.1:8080 --no-verify --verbose all

# Specific module with slow rate
python fuzz_maps.py --delay 2.0 fields

# Pre-production endpoint (more permissive)
python fuzz_maps.py --ppe report-types