# DefenderRuleParser Tool designed to analyze and extract detection rules from Microsoft Defender binary signature files. **Note: This tool may generate per-threat human-readable information derived from Microsoft Defender definition data. Such data are intended for local research only and must not be published or redistributed (e.g., in issues, gists, or repositories). Please do not attach .vdm, .extracted, or .bin artifacts to public resources.** # Description This project aims to document and decode the internal structure of Defender’s signature database formats and provide insight into how various signature types operate. # Features Parses .bin signature files from Defender signature database (You can obtain them with the DefenderRules tool) Extracts threat information, including IDs, names, and associated signature types Supports a wide and growing range of signature formats Detects string-based, hash-based, registry, filepath, Lua, and other rule types Provides readable hex dumps and decoded patterns where applicable Designed to assist malware analysts and researchers # Requirements .NET Core or .NET Framework (compatible with C# 8.0+) Windows Defender installed PowerShell access (for retrieving threat catalog via Get-MpThreatCatalog) # Usage DefenderRuleParser DefenderRuleParser [--recursive] [--debug] Use RunMe3.bat to automate the parsing of all of .bin files # Arguments file.bin: A single Defender binary signature file folderPath: A folder containing multiple .bin files --recursive: (Optional) Recursively scan subfolders --debug: (Optional) Verbose mode with HEX dumps # Extensibility The tool is modular. New signature types can be supported by implementing a corresponding parser class and registering it in the signature dispatcher. This design allows continuous expansion as more undocumented Defender rules are discovered. # Research Focus This tool is intended for educational and security research purposes only. It does not modify, patch, or interfere with Microsoft Defender’s operation, and it does not redistribute Microsoft’s proprietary signature databases. Use responsibly and only on systems you own or are explicitly authorized to analyze. # Disclaimer The project is still in the testing phase. This tool is intended for educational and security analysis purposes only. Improper use may violate Microsoft's license agreements. Use responsibly and only on systems you own or are authorized to analyze. # Author Project: Andrea Cristaldi Linkedin, Cybersec4 Main article on this topic: Inside Microsoft Defender Engine: How Signature Types Are Parsed and Executed # License This project is licensed under the Apache2 License.