kara-4search / defender-detectionhistory-parser Goto Github PK

The files parsed by this application may be found on any Windows system, if they exist, under [root]\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\[numbered folder]\[File GUID]

NOTES

• The file header should be of the form: b'0800000008', or else it is not a valid DetectionHistory file.

• Immediately following the file header and before the first mention of "Magic Version", the GUID of the file is given in Big-Endian(?) representation, capped off by a b'24' at the end, signaling the end of the GUID and beginning of the DetectionHistory data.

• ThreatTrackingStartTime and all other timestamps are in FILETIME structure (UTC)

• Most hex numbers in this file are stored with a swapped endianness.