Skip to content
This repository was archived by the owner on Apr 13, 2026. It is now read-only.

DefenderRulesPlus v1.0.0

Latest

Choose a tag to compare

@hfiref0x hfiref0x released this 11 Apr 06:23
b7d3230

Almost complete rewrite of original DefenderRules.

  • code ported to NET 10
  • threat metadata now is the primary source of trust instead of defender.csv
  • added multiple new command line switches:
    • --catalog command instead of auto-running (and failing) PowerShell and depending on MS WinDefend providers which maybe missing on machine,
    • --quiet, (supress console output),
    • --no-export (supress threats export),
    • --stats-only (output only statistics),
    • --html (output results in html, preserve original DefenderRules behavior),
    • --threat (filter threat by name).
  • reduced noisy console output and improved summary reporting
  • fixed dropping valid threats that are missing from the external catalog (defender.csv)
  • uses threat names embedded in definitions with catalog names only as option
  • improved performance over original (signature type names, reading entire file into memory, hashsets, ordinal comparisons)
  • project structure has been reorganized