DefenderRuleParser

Tool designed to analyze and extract detection rules from Microsoft Defender binary signature files. Note: This tool may generate per-threat human-readable information derived from Microsoft Defender definition data. Such data are intended for local research only and must not be published or redistributed (e.g., in issues, gists, or repositories). Please do not attach .vdm, .extracted, or .bin artifacts to public resources.

Description

This project aims to document and decode the internal structure of Defender’s signature database formats and provide insight into how various signature types operate.

Features

Parses .bin signature files from Defender signature database (You can obtain them with the DefenderRules tool)

Extracts threat information, including IDs, names, and associated signature types

Supports a wide and growing range of signature formats

Detects string-based, hash-based, registry, filepath, Lua, and other rule types

Provides readable hex dumps and decoded patterns where applicable

Designed to assist malware analysts and researchers

Requirements

.NET Core or .NET Framework (compatible with C# 8.0+)

Windows Defender installed

PowerShell access (for retrieving threat catalog via Get-MpThreatCatalog)

Usage

DefenderRuleParser <file.bin> DefenderRuleParser [--recursive] [--debug]

Use RunMe3.bat to automate the parsing of all of .bin files

Arguments

file.bin: A single Defender binary signature file

folderPath: A folder containing multiple .bin files

--recursive: (Optional) Recursively scan subfolders

--debug: (Optional) Verbose mode with HEX dumps

Extensibility

The tool is modular. New signature types can be supported by implementing a corresponding parser class and registering it in the signature dispatcher. This design allows continuous expansion as more undocumented Defender rules are discovered.

Research Focus

This tool is intended for educational and security research purposes only. It does not modify, patch, or interfere with Microsoft Defender’s operation, and it does not redistribute Microsoft’s proprietary signature databases. Use responsibly and only on systems you own or are explicitly authorized to analyze.

Disclaimer

The project is still in the testing phase.

This tool is intended for educational and security analysis purposes only. Improper use may violate Microsoft's license agreements. Use responsibly and only on systems you own or are authorized to analyze.

Author

Project: Andrea Cristaldi Linkedin, Cybersec4

Main article on this topic: Inside Microsoft Defender Engine: How Signature Types Are Parsed and Executed

License

This project is licensed under the Apache2 License.