This repository was archived by the owner on Apr 13, 2026. It is now read-only.
Repository navigation
Almost complete rewrite of original DefenderRules.
- code ported to NET 10
- threat metadata now is the primary source of trust instead of defender.csv
- added multiple new command line switches:
- --catalog command instead of auto-running (and failing) PowerShell and depending on MS WinDefend providers which maybe missing on machine,
- --quiet, (supress console output),
- --no-export (supress threats export),
- --stats-only (output only statistics),
- --html (output results in html, preserve original DefenderRules behavior),
- --threat (filter threat by name).
- reduced noisy console output and improved summary reporting
- fixed dropping valid threats that are missing from the external catalog (defender.csv)
- uses threat names embedded in definitions with catalog names only as option
- improved performance over original (signature type names, reading entire file into memory, hashsets, ordinal comparisons)
- project structure has been reorganized