Peering into the Cloud: Decode Windows Defender’s MAPS Protocol with the MAPS Cloud Scanner
MAPS Cloud Scanner
A research tool for interacting with Windows Defender’s MAPS (Microsoft Active Protection Service) cloud-based file reputation and dynamic signature delivery system.
MAPS is the cloud backend that powers Defender’s real-time protection verdicts, sample submission pipeline, and dynamic signature (SDN/DSS) delivery. This tool speaks the same Bond CompactBinaryV1 protocol that the Defender client uses on the wire, enabling direct interaction with MAPS endpoints for security research purposes.
Features
- File Scanning – Submit files to MAPS and receive cloud verdicts (clean, malware, PUA, unknown)
- Hash Lookups – Query file reputation by SHA-256 without submitting the file
- URL Reputation – Check URLs against Defender’s cloud reputation service
- Heartbeat / Connectivity – Test connectivity to MAPS endpoints
- Local Analysis – Analyze PE metadata, imports, sections, and authenticode signatures offline
- Bond Protocol – Full CompactBinaryV1 serializer/deserializer matching Defender’s wire format
- Payload Inspection – Build, decode, and replay raw Bond payloads for protocol research
- API Fuzzing – Enumerate undocumented endpoints, hidden fields, report types, and server behavior
Install & Use
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
USDT (TRC20):
TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm
USDT (ERC20):
0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce
