DefenderRules

Tool designed to parse and analyze Microsoft Defender AV signature definition files

This tool may generate per-threat .bin files derived from Microsoft Defender definition data. These files are intended for local research only and must not be published or redistributed (e.g., in issues, gists, or repositories). Do not attach .vdm, .extracted, or .bin artifacts to public resources.

Description

DefenderRules is a tool designed to parse and analyze Microsoft Defender signature definition files (extracted from .vdm using tools like DefenderDecompress). It extracts metadata about threats, parses rule types, and generates:

A list of discovered threats Missing threat definitions Statistical breakdown of signature types Interactive charts for analysis

Requirements

.NET Core or .NET Framework (compatible with C# 8.0+)

Windows Defender installed

PowerShell access (for retrieving threat catalog via Get-MpThreatCatalog)

Usage

DefenderRules.exe

you can use RunMe2.bat (please config path and referement)

Example

DefenderRules.exe mpasbase.vdm.decompressed ./output

This will:

Load the defender.csv threat catalog (auto-downloads via PowerShell if missing)

Extract all threat entries from the Defender binary

Save binary rule data into individual files

Output logs, statistics, and two HTML dashboards

Output:

File Name	Description
output.txt	List of all identified threat entries
missing.txt	Threats found in catalog but not in binary
ThreatsStats.csv	Threat-by-threat signature type counts
ThreatsGlobalStats.csv	Total signature type usage across all threats
Top30GlobalStatsChart.html	Interactive bar chart of most common signature types
ThreatGroupStatsCharts.html	Grouped charts by threat category
<ThreatName>.bin	Binary data for each threat rule

Disclaimer

This tool is intended for educational and security analysis purposes only. Improper use may violate Microsoft's license agreements. Use responsibly and only on systems you own or are authorized to analyze.

Author

Project: Andrea Cristaldi Linkedin, Cybersec4

License

This project is licensed under the MIT License.