# dtFabric format specification.
---
name: windefender_history
type: format
description: Windows Defender scan DetectionHistory file format
urls: ["https://github.com/libyal/dtformats/blob/main/documentation/Windows%20Defender%20scan%20DetectionHistory%20file%20format.asciidoc"]
---
name: byte
type: integer
attributes:
  format: unsigned
  size: 1
  units: bytes
---
name: uint8
type: integer
attributes:
  format: unsigned
  size: 1
  units: bytes
---
name: uint16
type: integer
attributes:
  format: unsigned
  size: 2
  units: bytes
---
name: uint32
type: integer
attributes:
  format: unsigned
  size: 4
  units: bytes
---
name: uint32le
type: integer
attributes:
  byte_order: little-endian
  format: unsigned
  size: 4
  units: bytes
---
name: uint64
type: integer
attributes:
  format: unsigned
  size: 8
  units: bytes
---
name: detection_history_value_base
type: structure
attributes:
  byte_order: little-endian
members:
- name: data_size
  data_type: uint32
- name: data_type
  data_type: uint32
- name: data
  type: stream
  element_data_type: byte
  elements_data_size: detection_history_value_base.data_size
- name: alignment_padding
  type: padding
  alignment_size: 8
---
name: detection_history_value_32bit
type: structure
attributes:
  byte_order: little-endian
members:
- name: data_size
  data_type: uint32
  value: 4
- name: data_type
  data_type: uint32
  values: [0x00000000, 0x00000005, 0x00000006]
- name: value_integer
  data_type: uint32
- name: alignment_padding
  type: padding
  alignment_size: 8
---
name: detection_history_value_64bit
type: structure
attributes:
  byte_order: little-endian
members:
- name: data_size
  data_type: uint32
  value: 8
- name: data_type
  data_type: uint32
  value: 0x00000008
- name: value_integer
  data_type: uint64
- name: alignment_padding
  type: padding
  alignment_size: 8
---
name: detection_history_value_binary_data
type: structure
attributes:
  byte_order: little-endian
members:
- name: data_size
  data_type: uint32
- name: data_type
  data_type: uint32
  value: 0x00000028
- name: data
  type: stream
  element_data_type: byte
  elements_data_size: detection_history_value_binary_data.data_size
- name: alignment_padding
  type: padding
  alignment_size: 8
---
name: detection_history_value_filetime
type: structure
attributes:
  byte_order: little-endian
members:
- name: data_size
  data_type: uint32
  value: 8
- name: data_type
  data_type: uint32
  value: 0x0000000a
- name: value_filetime
  data_type: uint64
- name: alignment_padding
  type: padding
  alignment_size: 8
---
name: detection_history_value_guid
type: structure
attributes:
  byte_order: little-endian
members:
- name: data_size
  data_type: uint32
  value: 16
- name: data_type
  data_type: uint32
  value: 0x0000001e
- name: value_guid
  type: uuid
- name: alignment_padding
  type: padding
  alignment_size: 8
---
name: detection_history_value_string
type: structure
attributes:
  byte_order: little-endian
members:
- name: data_size
  data_type: uint32
- name: data_type
  data_type: uint32
  value: 0x00000015
- name: value_string
  type: string
  encoding: utf-16-le
  element_data_type: byte
  elements_data_size: detection_history_value_string.data_size
  elements_terminator: "\x00\x00"
- name: alignment_padding
  type: padding
  alignment_size: 8
---
name: detection_history_value
type: structure-group
base: detection_history_value_base
identifier: data_type
members:
- detection_history_value_32bit
- detection_history_value_64bit
- detection_history_value_binary_data
- detection_history_value_filetime
- detection_history_value_guid
- detection_history_value_string
---
name: threat_tracking_header
type: structure
attributes:
  byte_order: little-endian
members:
- name: version
  data_type: uint32
- name: header_size
  data_type: uint32
- name: values_data_size
  data_type: uint32
- name: total_data_size
  data_type: uint32
- name: unknown2
  data_type: uint32
---
name: threat_tracking_value_base
type: structure
attributes:
  byte_order: little-endian
members:
- name: key_string_size
  data_type: uint32
- name: key_string
  type: string
  encoding: utf-16-le
  element_data_type: byte
  elements_data_size: threat_tracking_value_base.key_string_size
  elements_terminator: "\x00\x00"
- name: value_type
  data_type: uint32
---
name: threat_tracking_value_5bytes
type: structure
attributes:
  byte_order: little-endian
members:
- name: key_string_size
  data_type: uint32
- name: key_string
  type: string
  encoding: utf-16-le
  element_data_type: byte
  elements_data_size: threat_tracking_value_5bytes.key_string_size
  elements_terminator: "\x00\x00"
- name: value_type
  data_type: uint32
  value: 0x00000007
- name: value_data
  type: stream
  element_data_type: byte
  elements_data_size: 5
---
name: threat_tracking_value_8bit
type: structure
attributes:
  byte_order: little-endian
members:
- name: key_string_size
  data_type: uint32
- name: key_string
  type: string
  encoding: utf-16-le
  element_data_type: byte
  elements_data_size: threat_tracking_value_8bit.key_string_size
  elements_terminator: "\x00\x00"
- name: value_type
  data_type: uint32
  value: 0x00000005
- name: value_integer
  data_type: uint8
---
name: threat_tracking_value_32bit
type: structure
attributes:
  byte_order: little-endian
members:
- name: key_string_size
  data_type: uint32
- name: key_string
  type: string
  encoding: utf-16-le
  element_data_type: byte
  elements_data_size: threat_tracking_value_32bit.key_string_size
  elements_terminator: "\x00\x00"
- name: value_type
  data_type: uint32
  value: 0x00000003
- name: value_integer
  data_type: uint32
---
name: threat_tracking_value_64bit
type: structure
attributes:
  byte_order: little-endian
members:
- name: key_string_size
  data_type: uint32
- name: key_string
  type: string
  encoding: utf-16-le
  element_data_type: byte
  elements_data_size: threat_tracking_value_64bit.key_string_size
  elements_terminator: "\x00\x00"
- name: value_type
  data_type: uint32
  value: 0x00000004
- name: value_integer
  data_type: uint64
---
name: threat_tracking_value_string
type: structure
attributes:
  byte_order: little-endian
members:
- name: key_string_size
  data_type: uint32
- name: key_string
  type: string
  encoding: utf-16-le
  element_data_type: byte
  elements_data_size: threat_tracking_value_string.key_string_size
  elements_terminator: "\x00\x00"
- name: value_type
  data_type: uint32
  value: 0x00000006
- name: value_string_size
  data_type: uint32
- name: value_string
  type: string
  encoding: utf-16-le
  element_data_type: byte
  elements_data_size: threat_tracking_value_string.value_string_size
  elements_terminator: "\x00\x00"
---
name: threat_tracking_value
type: structure-group
base: threat_tracking_value_base
identifier: value_type
members:
- threat_tracking_value_5bytes
- threat_tracking_value_8bit
- threat_tracking_value_32bit
- threat_tracking_value_64bit
- threat_tracking_value_string
