Skip to content
Enumerate Windows Defender threat families and dump their names according category
C C++
Branch: master
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Type Name Latest commit message Commit time
Failed to load latest commit information.
Bin v 1.0.2 May 27, 2019
Dump v 1.0.2 May 27, 2019
Source v 1.0.2 May 27, 2019
LICENSE v 1.0.2 May 27, 2019
MpEnum.sha256 v 1.0.2 May 27, 2019 v 1.0.2 May 27, 2019


Enumerate Windows Defender threat families and dump their names according category.

System Requirements

  • x86/x64 Windows 8/8.1/10;
  • R/W access to the current directory to be able save results;
  • Windows Defender Client.


No specific usage required. Just run compiled executable (in command prompt for better experience).


Included dump of following versions:

  • AV Signatures: 1.273.443.0 / 1.273.1601.0 / / 1.293.2098.0
  • AS Signatures: 1.273.443.0 / 1.273.1601.0 / / 1.293.2098.0
  • NIS Signatures: 1.273.443.0 / 1.273.1601.0 / / 1.293.2098.0


Several categories are declared obsolete by MS and families moved to other categories (e.g Nuker category) or messed up with different categories for example TrojanDownloader:Win32/Delf, TrojanDownloader:Win32/Admedia and Trojan:Win32/NewCell in PUA category despite they have Trojan/TrojanDownloader family in their names.


MpEnum comes with full source code written in C. Please note that included MpClient.h is build on official available Microsoft documentation with fixes and updates that actually make it work. It maybe different from MS private version. In order to build from source you need Microsoft Visual Studio 2015 and later versions.


  • Select Platform ToolSet first for project in solution you want to build (Project->Properties->General):
    • v120 for Visual Studio 2013;
    • v140 for Visual Studio 2015;
    • v141 for Visual Studio 2017.
  • For v140 and above set Target Platform Version (Project->Properties->General):
    • If v140 then select 8.1 (Note that Windows 8.1 SDK must be installed);
    • If v141 then select 10.0.17134.0 (Note that Windows 10.0.17134 SDK must be installed).


(c) 2018 - 2019 MpEnum Project

You can’t perform that action at this time.