Twice Shell

[ EDITING: ProtectionManagement.mof ]

#pragma autorecover
#pragma namespace("\\\\.\\root\\Microsoft\\Windows\\Defender")

Instance of __Win32Provider as $prov
{
  Name = "ProtectionManagement";
  ClsId = "{A7C452EF-8E9F-42EB-9F2B-245613CA0DC9}";
  ImpersonationLevel = 1;
  HostingModel = "LocalServiceHost";
  version = 1073741825;
};

Instance of __MethodProviderRegistration
{
  Provider = $prov;
};

Instance of __EventProviderRegistration
{
  Provider = $prov;
  eventQueryList = {"select * from MSFT_MpEvent"};
};

Instance of __InstanceProviderRegistration
{
  Provider = $prov;
  supportsGet = TRUE;
  supportsPut = TRUE;
  supportsDelete = TRUE;
  supportsEnumeration = TRUE;
  QuerySupportLevels;
};

[locale(1033)] 
class BaseStatus
{
};

[dynamic : ToInstance,provider("ProtectionManagement") : ToInstance,locale(1033)] 
class MSFT_MpBehavioralNetworkBlockingRules : BaseStatus
{
  [key,read : ToSubclass] string FilterGUID = "";
  [read : ToSubclass] string IpAddress;
  [read : ToSubclass] string Type;
  [read : ToSubclass] string Direction;
  [read : ToSubclass] string Protocol;
  [read : ToSubclass] string LocalPorts;
  [read : ToSubclass] string RemotePorts;
  [read : ToSubclass] datetime CreationTime;
  [read : ToSubclass] datetime ExpirationTime;
  [implemented,static : ToSubclass DisableOverride] uint32 Remove([In] string FilterGUID);
};

[dynamic : ToInstance,provider("ProtectionManagement") : ToInstance,locale(1033)] 
class MSFT_MpComputerStatus : BaseStatus
{
  [read : ToSubclass,key] string ComputerID = "";
  [BitMap{"0", "1", "2", "4", "8", "16"} : ToSubclass,read : ToSubclass] uint32 ComputerState = 0;
  [read : ToSubclass] boolean RebootRequired;
  [BitMap{"0", "1", "2", "4", "8", "16", "32", "64", "128", "256", "512", "1024", "2048", "4096", "8192", "16384", "32768", "65536", "131072", "262144", "524288", "1048576", "2097152", "4194304", "8388608", "16777216"} : ToSubclass,read : ToSubclass] uint32 ProductStatus = 0;
  [read : ToSubclass] string AMRunningMode = "";
  [read : ToSubclass] string AMProductVersion = "";
  [read : ToSubclass] string AMServiceVersion = "";
  [read : ToSubclass] boolean DefenderSignaturesOutOfDate;
  string AntispywareSignatureVersion = "";
  [read : ToSubclass] uint32 AntispywareSignatureAge = 0;
  [read : ToSubclass] datetime AntispywareSignatureLastUpdated;
  [read : ToSubclass] string AntivirusSignatureVersion = "";
  [read : ToSubclass] uint32 AntivirusSignatureAge = 0;
  [read : ToSubclass] datetime AntivirusSignatureLastUpdated;
  string NISSignatureVersion = "";
  [read : ToSubclass] uint32 NISSignatureAge = 0;
  [read : ToSubclass] datetime NISSignatureLastUpdated;
  [read : ToSubclass] datetime FullScanStartTime;
  [read : ToSubclass] datetime FullScanEndTime;
  [read : ToSubclass] uint32 FullScanAge = 0;
  [ValueMap{"0", "1", "2", "3", "4"} : ToSubclass,read : ToSubclass] uint8 LastFullScanSource = 0;
  [read : ToSubclass] string FullScanSignatureVersion = "";
  [read : ToSubclass] boolean FullScanOverdue;
  [read : ToSubclass] boolean FullScanRequired;
  [ValueMap{"0", "1", "2"} : ToSubclass,read : ToSubclass] uint8 RealTimeScanDirection = 0;
  [read : ToSubclass] datetime QuickScanStartTime;
  [read : ToSubclass] datetime QuickScanEndTime;
  [read : ToSubclass] uint32 QuickScanAge = 0;
  [ValueMap{"0", "1", "2", "3", "4"} : ToSubclass,read : ToSubclass] uint8 LastQuickScanSource = 0;
  [read : ToSubclass] string QuickScanSignatureVersion = "";
  [read : ToSubclass] boolean QuickScanOverdue;
  [read : ToSubclass] string AMEngineVersion = "";
  [read : ToSubclass] boolean AMServiceEnabled = FALSE;
  [read : ToSubclass] boolean OnAccessProtectionEnabled = FALSE;
  [read : ToSubclass] boolean IoavProtectionEnabled = FALSE;
  [read : ToSubclass] boolean BehaviorMonitorEnabled = FALSE;
  [read : ToSubclass] boolean AntivirusEnabled = FALSE;
  [read : ToSubclass] boolean AntispywareEnabled = FALSE;
  [read : ToSubclass] boolean IsVirtualMachine = FALSE;
  [read : ToSubclass] boolean IsTamperProtected = FALSE;
  [read : ToSubclass] string TamperProtectionSource = "";
  [read : ToSubclass] boolean RealTimeProtectionEnabled = FALSE;
  [read : ToSubclass] string NISEngineVersion = "";
  [read : ToSubclass] boolean NISEnabled = FALSE;
  [read : ToSubclass] string DeviceControlState = "";
  [read : ToSubclass] string DeviceControlDefaultEnforcement = "";
  [read : ToSubclass] datetime DeviceControlPoliciesLastUpdated;
  [read : ToSubclass] string TroubleShootingMode = "";
  [read : ToSubclass] string TroubleShootingStartTime = "";
  [read : ToSubclass] string TroubleShootingEndTime = "";
  [read : ToSubclass] string TroubleShootingExpirationLeft = "";
  [read : ToSubclass] string TroubleShootingDailyQuotaLeft = "";
  [read : ToSubclass] string TroubleShootingQuotaResetTime = "";
  [read : ToSubclass] string TroubleShootingDailyMaxQuota = "";
  [read : ToSubclass] string TroubleShootingModeSource = "";
  [read : ToSubclass] string SmartAppControlState = "";
  [read : ToSubclass] string SmartAppControlExpiration = "";
  [read : ToSubclass] string InitializationProgress = "";
  [read : ToSubclass] uint8 ControlledConfigurationState = 0;
};

[Indication : ToSubclass DisableOverride,dynamic : ToInstance,provider("ProtectionManagement") : ToInstance,locale(1033)] 
class MSFT_MpEvent
{
  [ValueMap{"1", "2", "4", "8"} : ToSubclass,read : ToSubclass,key] uint32 CategoryDiscriminant;
  [BitMap{"1", "2"} : ToSubclass,read : ToSubclass] uint32 ScanNotificationsValue;
  [BitMap{"1", "2", "4", "8", "16"} : ToSubclass,read : ToSubclass] uint32 ThreatNotificationsValue;
  [BitMap{"1"} : ToSubclass,read : ToSubclass] uint32 SignatureNotificationsValue;
  [BitMap{"1", "2", "4", "8", "16", "32", "64"} : ToSubclass,read : ToSubclass] uint32 ComputerNotificationsValue;
  [read : ToSubclass] datetime NotificationTime;
  [read : ToSubclass] sint64 AdditionalData;
};

[dynamic : ToInstance,provider("ProtectionManagement") : ToInstance,locale(1033)] 
class MSFT_MpHeartBeat
{
  [implemented,static : ToSubclass DisableOverride] uint32 Send();
};

[dynamic : ToInstance,provider("ProtectionManagement") : ToInstance,locale(1033)] 
class MSFT_MpPreference
{
  [read : ToSubclass,key] string ComputerID = "";
  boolean DisableAutoExclusions = FALSE;
  string ExclusionPath[];
  string ExclusionExtension[];
  string ExclusionProcess[];
  string ExclusionIpAddress[];
  uint32 QuarantinePurgeItemsAfterDelay;
  [ValueMap{"0", "1", "2"} : ToSubclass] uint8 RealTimeScanDirection = 0;
  [ValueMap{"0", "1", "2", "3", "4", "5", "6", "7", "8"} : ToSubclass] uint8 RemediationScheduleDay;
  datetime RemediationScheduleTime;
  [ValueMap{"0", "1", "2", "4"} : ToSubclass] uint8 RemoteEncryptionProtectionConfiguredState;
  uint32 RemoteEncryptionProtectionMaxBlockTime;
  [ValueMap{"0", "1", "2"} : ToSubclass] uint8 RemoteEncryptionProtectionAggressiveness;
  string RemoteEncryptionProtectionExclusions[];
  [ValueMap{"0", "1", "2", "4"} : ToSubclass] uint8 BruteForceProtectionConfiguredState;
  uint32 BruteForceProtectionMaxBlockTime;
  [ValueMap{"0", "1", "2"} : ToSubclass] uint8 BruteForceProtectionAggressiveness;
  string BruteForceProtectionExclusions[];
  boolean BruteForceProtectionLocalNetworkBlocking;
  boolean BruteForceProtectionSkipLearningPeriod;
  uint32 ReportingAdditionalActionTimeOut;
  uint32 ReportingCriticalFailureTimeOut;
  uint32 ReportingNonCriticalTimeOut;
  uint32 ServiceHealthReportInterval;
  boolean ReportDynamicSignatureDroppedEvent;
  uint8 ScanAvgCPULoadFactor;
  boolean CheckForSignaturesBeforeRunningScan;
  uint32 ScanPurgeItemsAfterDelay;
  boolean ScanOnlyIfIdleEnabled;
  [ValueMap{"1", "2"} : ToSubclass] uint8 ScanParameters;
  [ValueMap{"0", "1", "2", "3", "4", "5", "6", "7", "8"} : ToSubclass] uint8 ScanScheduleDay;
  datetime ScanScheduleQuickScanTime;
  datetime ScanScheduleTime;
  boolean ThrottleForScheduledScanOnly;
  uint32 SignatureFirstAuGracePeriod;
  uint32 SignatureAuGracePeriod;
  string SignatureDefinitionUpdateFileSharesSources;
  boolean SignatureDisableUpdateOnStartupWithoutEngine;
  string SignatureFallbackOrder;
  [ValueMap{"0", "1", "2", "3", "4", "5", "6", "7", "8"} : ToSubclass] uint8 SignatureScheduleDay;
  datetime SignatureScheduleTime;
  uint32 SignatureUpdateCatchupInterval;
  uint32 SignatureUpdateInterval;
  string SignatureBlobFileSharesSources;
  uint32 SignatureBlobUpdateInterval;
  [ValueMap{"0", "1", "2"} : ToSubclass] uint8 MAPSReporting;
  [ValueMap{"0", "1", "2", "3"} : ToSubclass] uint8 SubmitSamplesConsent;
  boolean DisablePrivacyMode;
  boolean RandomizeScheduleTaskTimes;
  uint32 SchedulerRandomizationTime;
  boolean DisableBehaviorMonitoring;
  boolean DisableIOAVProtection;
  boolean DisableRealtimeMonitoring;
  boolean DisableScriptScanning;
  boolean DisableArchiveScanning;
  boolean DisableCatchupFullScan;
  boolean DisableCatchupQuickScan;
  boolean DisableEmailScanning;
  boolean DisableRemovableDriveScanning;
  boolean DisableRestorePoint;
  boolean DisableScanningMappedNetworkDrivesForFullScan;
  boolean DisableScanningNetworkFiles;
  boolean ApplyDisableNetworkScanningToIOAV;
  boolean UILockdown;
  sint64 ThreatIDDefaultAction_Ids[];
  [ValueMap{"1", "2", "3", "6", "8", "9", "10", "11"} : ToSubclass] uint8 ThreatIDDefaultAction_Actions[];
  [ValueMap{"1", "2", "3", "6", "8", "9", "10", "11"} : ToSubclass] uint8 UnknownThreatDefaultAction;
  [ValueMap{"1", "2", "3", "6", "8", "9", "10", "11"} : ToSubclass] uint8 LowThreatDefaultAction;
  [ValueMap{"1", "2", "3", "6", "8", "9", "10", "11"} : ToSubclass] uint8 ModerateThreatDefaultAction;
  [ValueMap{"1", "2", "3", "6", "8", "9", "10", "11"} : ToSubclass] uint8 HighThreatDefaultAction;
  [ValueMap{"1", "2", "3", "6", "8", "9", "10", "11"} : ToSubclass] uint8 SevereThreatDefaultAction;
  [ValueMap{"0", "1", "2"} : ToSubclass] uint8 PUAProtection;
  boolean DisableBlockAtFirstSeen;
  [ValueMap{"0", "1", "2", "4", "6"} : ToSubclass] uint8 CloudBlockLevel;
  uint32 CloudExtendedTimeout;
  [ValueMap{"0", "1", "2"} : ToSubclass] uint8 EnableNetworkProtection;
  [ValueMap{"0", "1", "2", "3", "4"} : ToSubclass] uint8 EnableControlledFolderAccess;
  string AttackSurfaceReductionOnlyExclusions[];
  string AttackSurfaceReductionRules_Ids[];
  [ValueMap{"0", "1", "2", "5", "6"} : ToSubclass] uint8 AttackSurfaceReductionRules_Actions[];
  string ControlledFolderAccessAllowedApplications[];
  string ControlledFolderAccessProtectedFolders[];
  string ControlledFolderAccessDefaultProtectedFolders[];
  string SharedSignaturesPath;
  boolean SharedSignaturesPathUpdateAtScheduledTimeOnly;
  boolean EnableLowCpuPriority;
  boolean EnableFileHashComputation;
  boolean MeteredConnectionUpdates;
  boolean AllowNetworkProtectionOnWinServer;
  boolean DisableDatagramProcessing;
  boolean EnableConvertWarnToBlock;
  boolean DisableCpuThrottleOnIdleScans;
  boolean EnableFullScanOnBatteryPower;
  string ProxyPacUrl;
  string ProxyServer;
  string ProxyBypass[];
  boolean ForceUseProxyOnly;
  boolean DisableTlsParsing;
  boolean DisableHttpParsing;
  boolean DisableDnsParsing;
  boolean DisableDnsOverTcpParsing;
  boolean DisableSshParsing;
  [ValueMap{"0", "2", "3", "4", "5", "6"} : ToSubclass] uint8 PlatformUpdatesChannel;
  [ValueMap{"0", "2", "3", "4", "5", "6"} : ToSubclass] uint8 EngineUpdatesChannel;
  [ValueMap{"0", "4", "5"} : ToSubclass] uint8 DefinitionUpdatesChannel;
  [ValueMap{"0", "10", "20", "30", "40", "50"} : ToSubclass] uint8 DeploymentChannel;
  boolean DisableGradualRelease;
  boolean AllowNetworkProtectionDownLevel;
  boolean AllowDatagramProcessingOnWinServer;
  boolean EnableDnsSinkhole;
  boolean DisableInboundConnectionFiltering;
  boolean DisableRdpParsing;
  boolean DisableNetworkProtectionPerfTelemetry;
  uint32 TrustLabelProtectionStatus;
  boolean HideExclusionsFromLocalUsers;
  boolean DisableFtpParsing;
  boolean AllowSwitchToAsyncInspection;
  uint32 ScanScheduleOffset;
  boolean DisableTamperProtection;
  boolean DisableSmtpParsing;
  boolean DisableQuicParsing;
  uint32 NetworkProtectionReputationMode;
  boolean IntelTDTEnabled;
  string AttackSurfaceReductionRules_RuleSpecificExclusions_Id[];
  string AttackSurfaceReductionRules_RuleSpecificExclusions[];
  boolean OobeEnableRtpAndSigUpdate;
  [ValueMap{"0", "1"} : ToSubclass] uint8 PerformanceModeStatus;
  boolean DisableCacheMaintenance;
  [ValueMap{"0", "1"} : ToSubclass] uint8 QuickScanIncludeExclusions;
  boolean RemoveScanningThreadPoolCap;
  boolean DisableCoreServiceECSIntegration;
  boolean DisableCoreServiceTelemetry;
  boolean EnableUdpSegmentationOffload;
  boolean EnableUdpReceiveOffload;
  [ValueMap{"0", "1", "2"} : ToSubclass] uint8 AiAgentProtection = 0;
  [ValueMap{"0", "1", "2"} : ToSubclass] uint8 AiAgentNetworkInspection = 0;
  [implemented,static : ToSubclass DisableOverride] uint32 Set([In] boolean DisableAutoExclusions,[In] string ExclusionPath[],[In] string ExclusionExtension[],[In] string ExclusionProcess[],[In] string ExclusionIpAddress[],[In] uint32 QuarantinePurgeItemsAfterDelay,[In,ValueMap{"0", "1", "2"} : ToSubclass] uint8 RealTimeScanDirection,[In,ValueMap{"0", "1", "2", "3", "4", "5", "6", "7", "8"} : ToSubclass] uint8 RemediationScheduleDay,[In] datetime RemediationScheduleTime,[In,ValueMap{"0", "1", "2", "4"} : ToSubclass] uint8 RemoteEncryptionProtectionConfiguredState,[In] uint32 RemoteEncryptionProtectionMaxBlockTime,[In,ValueMap{"0", "1", "2"} : ToSubclass] uint8 RemoteEncryptionProtectionAggressiveness,[In] string RemoteEncryptionProtectionExclusions[],[In,ValueMap{"0", "1", "2", "4"} : ToSubclass] uint8 BruteForceProtectionConfiguredState,[In] uint32 BruteForceProtectionMaxBlockTime,[In,ValueMap{"0", "1", "2"} : ToSubclass] uint8 BruteForceProtectionAggressiveness,[In] string BruteForceProtectionExclusions[],[In] boolean BruteForceProtectionLocalNetworkBlocking,[In] boolean BruteForceProtectionSkipLearningPeriod,[In] uint32 ReportingAdditionalActionTimeOut,[In] uint32 ReportingCriticalFailureTimeOut,[In] uint32 ReportingNonCriticalTimeOut,[In] uint32 ServiceHealthReportInterval,[In] boolean ReportDynamicSignatureDroppedEvent,[In] uint8 ScanAvgCPULoadFactor,[In] boolean CheckForSignaturesBeforeRunningScan,[In] uint32 ScanPurgeItemsAfterDelay,[In] boolean ScanOnlyIfIdleEnabled,[In,ValueMap{"1", "2"} : ToSubclass] uint8 ScanParameters,[In,ValueMap{"0", "1", "2", "3", "4", "5", "6", "7", "8"} : ToSubclass] uint8 ScanScheduleDay,[In] datetime ScanScheduleQuickScanTime,[In] datetime ScanScheduleTime,[In] boolean ThrottleForScheduledScanOnly,[In] uint32 SignatureFirstAuGracePeriod,[In] uint32 SignatureAuGracePeriod,[In] string SignatureDefinitionUpdateFileSharesSources,[In] boolean SignatureDisableUpdateOnStartupWithoutEngine,[In] string SignatureFallbackOrder,[In,ValueMap{"0", "1", "2", "3", "4", "5", "6", "7", "8"} : ToSubclass] uint8 SignatureScheduleDay,[In] datetime SignatureScheduleTime,[In] uint32 SignatureUpdateCatchupInterval,[In] string SignatureBlobFileSharesSources,[In] uint32 SignatureUpdateInterval,[In] uint32 SignatureBlobUpdateInterval,[In,ValueMap{"0", "1", "2"} : ToSubclass] uint8 MAPSReporting,[In,ValueMap{"0", "1", "2", "3"} : ToSubclass] uint8 SubmitSamplesConsent,[In] boolean DisablePrivacyMode,[In] boolean RandomizeScheduleTaskTimes,[In] uint32 SchedulerRandomizationTime,[In] boolean DisableBehaviorMonitoring,[In] boolean DisableIntrusionPreventionSystem,[In] boolean DisableIOAVProtection,[In] boolean DisableRealtimeMonitoring,[In] boolean DisableScriptScanning,[In] boolean DisableArchiveScanning,[In] boolean DisableCatchupFullScan,[In] boolean DisableCatchupQuickScan,[In] boolean DisableEmailScanning,[In] boolean DisableRemovableDriveScanning,[In] boolean DisableRestorePoint,[In] boolean DisableScanningMappedNetworkDrivesForFullScan,[In] boolean DisableScanningNetworkFiles,[In] boolean ApplyDisableNetworkScanningToIOAV,[In] boolean UILockdown,[In] sint64 ThreatIDDefaultAction_Ids[],[In,ValueMap{"1", "2", "3", "6", "8", "9", "10", "11"} : ToSubclass] uint8 ThreatIDDefaultAction_Actions[],[In,ValueMap{"1", "2", "3", "6", "8", "9", "10", "11"} : ToSubclass] uint8 UnknownThreatDefaultAction,[In,ValueMap{"1", "2", "3", "6", "8", "9", "10", "11"} : ToSubclass] uint8 LowThreatDefaultAction,[In,ValueMap{"1", "2", "3", "6", "8", "9", "10", "11"} : ToSubclass] uint8 ModerateThreatDefaultAction,[In,ValueMap{"1", "2", "3", "6", "8", "9", "10", "11"} : ToSubclass] uint8 HighThreatDefaultAction,[In,ValueMap{"1", "2", "3", "6", "8", "9", "10", "11"} : ToSubclass] uint8 SevereThreatDefaultAction,[In,ValueMap{"0", "1", "2"} : ToSubclass] uint8 PUAProtection,[In] boolean DisableBlockAtFirstSeen,[In,ValueMap{"0", "1", "2", "4", "6"} : ToSubclass] uint8 CloudBlockLevel,[In] uint32 CloudExtendedTimeout,[In,ValueMap{"0", "1", "2"} : ToSubclass] uint8 EnableNetworkProtection,[In,ValueMap{"0", "1", "2", "3", "4"} : ToSubclass] uint8 EnableControlledFolderAccess,[In] string AttackSurfaceReductionOnlyExclusions[],[In] string AttackSurfaceReductionRules_Ids[],[In,ValueMap{"0", "1", "2", "5", "6"} : ToSubclass] uint8 AttackSurfaceReductionRules_Actions[],[In] string ControlledFolderAccessAllowedApplications[],[In] string ControlledFolderAccessProtectedFolders[],[In] string SharedSignaturesPath,[In] boolean SharedSignaturesPathUpdateAtScheduledTimeOnly,[In] boolean EnableLowCpuPriority,[In] boolean EnableFileHashComputation,[In] boolean MeteredConnectionUpdates,[In] boolean AllowNetworkProtectionOnWinServer,[In] boolean DisableDatagramProcessing,[In] boolean EnableConvertWarnToBlock,[In] boolean DisableCpuThrottleOnIdleScans,[In] boolean EnableFullScanOnBatteryPower,[In] string ProxyPacUrl,[In] string ProxyServer,[In] string ProxyBypass[],[In] boolean ForceUseProxyOnly,[In] boolean DisableTlsParsing,[In] boolean DisableHttpParsing,[In] boolean DisableDnsParsing,[In] boolean DisableDnsOverTcpParsing,[In] boolean DisableSshParsing,[In,ValueMap{"0", "2", "3", "4", "5", "6"} : ToSubclass] uint8 PlatformUpdatesChannel,[In,ValueMap{"0", "2", "3", "4", "5", "6"} : ToSubclass] uint8 EngineUpdatesChannel,[In,ValueMap{"0", "4", "5"} : ToSubclass] uint8 DefinitionUpdatesChannel,[In,ValueMap{"0", "10", "20", "30", "40", "50"} : ToSubclass] uint8 DeploymentChannel,[In] boolean DisableGradualRelease,[In] boolean AllowNetworkProtectionDownLevel,[In] boolean AllowDatagramProcessingOnWinServer,[In] boolean EnableDnsSinkhole,[In] boolean DisableInboundConnectionFiltering,[In] boolean DisableRdpParsing,[In] boolean DisableNetworkProtectionPerfTelemetry,[In] uint32 TrustLabelProtectionStatus,[In] boolean DisableFtpParsing,[In] boolean AllowSwitchToAsyncInspection,[In] uint32 ScanScheduleOffset,[In] boolean DisableTDTFeature,[In] boolean DisableTamperProtection,[In] boolean DisableSmtpParsing,[In] boolean DisableQuicParsing,[In] uint32 NetworkProtectionReputationMode,[In] boolean IntelTDTEnabled,[In] string AttackSurfaceReductionRules_RuleSpecificExclusions_Id[],[In] string AttackSurfaceReductionRules_RuleSpecificExclusions[],[In] boolean OobeEnableRtpAndSigUpdate,[In,ValueMap{"0", "1"} : ToSubclass] uint8 PerformanceModeStatus,[In,ValueMap{"0", "1"} : ToSubclass] uint8 QuickScanIncludeExclusions,[In] boolean RemoveScanningThreadPoolCap,[In] boolean DisableCacheMaintenance,[In] boolean DisableCoreServiceECSIntegration,[In] boolean DisableCoreServiceTelemetry,[In] boolean EnableUdpSegmentationOffload,[In] boolean EnableUdpReceiveOffload,[In,ValueMap{"0", "1", "2"} : ToSubclass] uint8 AiAgentProtection,[In,ValueMap{"0", "1", "2"} : ToSubclass] uint8 AiAgentNetworkInspection,[In] boolean Force);
  [implemented,static : ToSubclass DisableOverride] uint32 Remove([In] boolean DisableAutoExclusions,[In] string ExclusionPath[],[In] string ExclusionExtension[],[In] string ExclusionProcess[],[In] string ExclusionIpAddress[],[In] boolean QuarantinePurgeItemsAfterDelay,[In,ValueMap{"0", "1", "2"} : ToSubclass] boolean RealTimeScanDirection,[In,ValueMap{"0", "1", "2", "3", "4", "5", "6", "7", "8"} : ToSubclass] boolean RemediationScheduleDay,[In] boolean RemediationScheduleTime,[In,ValueMap{"0", "1", "2", "4"} : ToSubclass] boolean RemoteEncryptionProtectionConfiguredState,[In] boolean RemoteEncryptionProtectionMaxBlockTime,[In,ValueMap{"0", "1", "2"} : ToSubclass] boolean RemoteEncryptionProtectionAggressiveness,[In] string RemoteEncryptionProtectionExclusions[],[In,ValueMap{"0", "1", "2", "4"} : ToSubclass] boolean BruteForceProtectionConfiguredState,[In] boolean BruteForceProtectionMaxBlockTime,[In,ValueMap{"0", "1", "2"} : ToSubclass] boolean BruteForceProtectionAggressiveness,[In] string BruteForceProtectionExclusions[],[In] boolean BruteForceProtectionLocalNetworkBlocking,[In] boolean BruteForceProtectionSkipLearningPeriod,[In] boolean ReportingAdditionalActionTimeOut,[In] boolean ReportingCriticalFailureTimeOut,[In] boolean ReportingNonCriticalTimeOut,[In] boolean ServiceHealthReportInterval,[In] boolean ReportDynamicSignatureDroppedEvent,[In] boolean ScanAvgCPULoadFactor,[In] boolean CheckForSignaturesBeforeRunningScan,[In] boolean ScanPurgeItemsAfterDelay,[In] boolean ScanOnlyIfIdleEnabled,[In,ValueMap{"1", "2"} : ToSubclass] boolean ScanParameters,[In,ValueMap{"0", "1", "2", "3", "4", "5", "6", "7", "8"} : ToSubclass] boolean ScanScheduleDay,[In] boolean ScanScheduleQuickScanTime,[In] boolean ScanScheduleTime,[In] boolean ThrottleForScheduledScanOnly,[In] boolean SignatureFirstAuGracePeriod,[In] boolean SignatureAuGracePeriod,[In] boolean SignatureDefinitionUpdateFileSharesSources,[In] boolean SignatureDisableUpdateOnStartupWithoutEngine,[In] boolean SignatureFallbackOrder,[In,ValueMap{"0", "1", "2", "3", "4", "5", "6", "7", "8"} : ToSubclass] boolean SignatureScheduleDay,[In] boolean SignatureScheduleTime,[In] boolean SignatureUpdateCatchupInterval,[In] boolean SignatureBlobFileSharesSources,[In] boolean SignatureUpdateInterval,[In] boolean SignatureBlobUpdateInterval,[In,ValueMap{"0", "1", "2"} : ToSubclass] boolean MAPSReporting,[In,ValueMap{"0", "1", "2", "3"} : ToSubclass] boolean SubmitSamplesConsent,[In] boolean DisablePrivacyMode,[In] boolean RandomizeScheduleTaskTimes,[In] boolean SchedulerRandomizationTime,[In] boolean DisableBehaviorMonitoring,[In] boolean DisableIntrusionPreventionSystem,[In] boolean DisableIOAVProtection,[In] boolean DisableRealtimeMonitoring,[In] boolean DisableScriptScanning,[In] boolean DisableArchiveScanning,[In] boolean DisableCatchupFullScan,[In] boolean DisableCatchupQuickScan,[In] boolean DisableEmailScanning,[In] boolean DisableRemovableDriveScanning,[In] boolean DisableRestorePoint,[In] boolean DisableScanningMappedNetworkDrivesForFullScan,[In] boolean DisableScanningNetworkFiles,[In] boolean ApplyDisableNetworkScanningToIOAV,[In] boolean UILockdown,[In] sint64 ThreatIDDefaultAction_Ids[],[In,ValueMap{"1", "2", "3", "6", "8", "9", "10", "11"} : ToSubclass] uint8 ThreatIDDefaultAction_Actions[],[In,ValueMap{"1", "2", "3", "6", "8", "9", "10", "11"} : ToSubclass] boolean UnknownThreatDefaultAction,[In,ValueMap{"1", "2", "3", "6", "8", "9", "10", "11"} : ToSubclass] boolean LowThreatDefaultAction,[In,ValueMap{"1", "2", "3", "6", "8", "9", "10", "11"} : ToSubclass] boolean ModerateThreatDefaultAction,[In,ValueMap{"1", "2", "3", "6", "8", "9", "10", "11"} : ToSubclass] boolean HighThreatDefaultAction,[In,ValueMap{"1", "2", "3", "6", "8", "9", "10", "11"} : ToSubclass] boolean SevereThreatDefaultAction,[In,ValueMap{"0", "1", "2"} : ToSubclass] boolean PUAProtection,[In] boolean DisableBlockAtFirstSeen,[In,ValueMap{"0", "1", "2", "4", "6"} : ToSubclass] boolean CloudBlockLevel,[In] boolean CloudExtendedTimeout,[In,ValueMap{"0", "1", "2"} : ToSubclass] boolean EnableNetworkProtection,[In,ValueMap{"0", "1", "2", "3", "4"} : ToSubclass] boolean EnableControlledFolderAccess,[In] string AttackSurfaceReductionOnlyExclusions[],[In] string AttackSurfaceReductionRules_Ids[],[In,ValueMap{"0", "1", "2", "5", "6"} : ToSubclass] uint8 AttackSurfaceReductionRules_Actions[],[In] string ControlledFolderAccessAllowedApplications[],[In] string ControlledFolderAccessProtectedFolders[],[In] boolean SharedSignaturesPath,[In] boolean SharedSignaturesPathUpdateAtScheduledTimeOnly,[In] boolean EnableLowCpuPriority,[In] boolean EnableFileHashComputation,[In] boolean MeteredConnectionUpdates,[In] boolean AllowNetworkProtectionOnWinServer,[In] boolean DisableDatagramProcessing,[In] boolean EnableConvertWarnToBlock,[In] boolean DisableCpuThrottleOnIdleScans,[In] boolean EnableFullScanOnBatteryPower,[In] boolean ProxyPacUrl,[In] boolean ProxyServer,[In] boolean ProxyBypass,[In] boolean ForceUseProxyOnly,[In] boolean DisableTlsParsing,[In] boolean DisableHttpParsing,[In] boolean DisableDnsParsing,[In] boolean DisableDnsOverTcpParsing,[In] boolean DisableSshParsing,[In] boolean PlatformUpdatesChannel,[In] boolean EngineUpdatesChannel,[In] boolean DefinitionUpdatesChannel,[In] boolean DeploymentChannel,[In] boolean DisableGradualRelease,[In] boolean AllowNetworkProtectionDownLevel,[In] boolean AllowDatagramProcessingOnWinServer,[In] boolean EnableDnsSinkhole,[In] boolean DisableInboundConnectionFiltering,[In] boolean DisableRdpParsing,[In] boolean DisableNetworkProtectionPerfTelemetry,[In] boolean TrustLabelProtectionStatus,[In] boolean DisableFtpParsing,[In] boolean AllowSwitchToAsyncInspection,[In] boolean ScanScheduleOffset,[In] boolean DisableTDTFeature,[In] boolean DisableSmtpParsing,[In] boolean DisableQuicParsing,[In] boolean NetworkProtectionReputationMode,[In] boolean IntelTDTEnabled,[In] string AttackSurfaceReductionRules_RuleSpecificExclusions_Id,[In] string AttackSurfaceReductionRules_RuleSpecificExclusions,[In] boolean OobeEnableRtpAndSigUpdate,[In,ValueMap{"0", "1"} : ToSubclass] boolean PerformanceModeStatus,[In,ValueMap{"0", "1"} : ToSubclass] boolean QuickScanIncludeExclusions,[In] boolean RemoveScanningThreadPoolCap,[In] boolean DisableCacheMaintenance,[In] boolean DisableCoreServiceECSIntegration,[In] boolean DisableCoreServiceTelemetry,[In] boolean EnableUdpSegmentationOffload,[In] boolean EnableUdpReceiveOffload,[In] boolean AiAgentProtection,[In] boolean AiAgentNetworkInspection,[In] boolean Force);
  [implemented,static : ToSubclass DisableOverride] uint32 Add([In] string ExclusionPath[],[In] string ExclusionExtension[],[In] string ExclusionProcess[],[In] string ExclusionIpAddress[],[In] sint64 ThreatIDDefaultAction_Ids[],[In,ValueMap{"1", "2", "3", "6", "8", "9", "10", "11"} : ToSubclass] uint8 ThreatIDDefaultAction_Actions[],[In] string AttackSurfaceReductionOnlyExclusions[],[In] string AttackSurfaceReductionRules_Ids[],[In,ValueMap{"0", "1", "2", "5", "6"} : ToSubclass] uint8 AttackSurfaceReductionRules_Actions[],[In] string ControlledFolderAccessAllowedApplications[],[In] string ControlledFolderAccessProtectedFolders[],[in] string SharedSignaturesPath,[In] string AttackSurfaceReductionRules_RuleSpecificExclusions_Id[],[In] string AttackSurfaceReductionRules_RuleSpecificExclusions[],[In] string RemoteEncryptionProtectionExclusions[],[In] string BruteForceProtectionExclusions[],[In] boolean Force);
};

[dynamic : ToInstance,provider("ProtectionManagement") : ToInstance,locale(1033)] 
class MSFT_MpRollback
{
  [implemented,static : ToSubclass DisableOverride] uint32 Start([In] boolean Engine,[In] boolean Platform);
};

[dynamic : ToInstance,provider("ProtectionManagement") : ToInstance,locale(1033)] 
class MSFT_MpScan
{
  [implemented,static : ToSubclass DisableOverride] uint32 Start([In] uint8 ScanType,[In] string ScanPath);
};

[dynamic : ToInstance,provider("ProtectionManagement") : ToInstance,locale(1033)] 
class MSFT_MpSignature
{
  [implemented,static : ToSubclass DisableOverride] uint32 Update([In] uint8 UpdateSource);
};

[dynamic : ToInstance,provider("ProtectionManagement") : ToInstance,locale(1033)] 
class MSFT_MpThreat : BaseStatus
{
  [read : ToSubclass] string SchemaVersion = "1.0.0.0";
  [key,read : ToSubclass] sint64 ThreatID;
  [read : ToSubclass] string ThreatName;
  [ValueMap{"0", "1", "2", "3", "4", "5"} : ToSubclass,read : ToSubclass] uint8 SeverityID;
  [ValueMap{"0", "1", "2", "3", "4", "5", "6", "7,8", "9", "10", "11", "12", "13", "14", "15", "16", "17", "18", "19", "20", "21", "22", "23", "24", "25", "26", "27", "28", "29", "30", "31", "32", "33", "34", "36", "37", "38", "39", "40", "42", "43", "44", "45", "46", "47", "48"} : ToSubclass,read : ToSubclass] uint8 CategoryID;
  [ValueMap{"0", "1", "2", "3", "4"} : ToSubclass,read : ToSubclass] uint8 TypeID;
  [BitMap{"0", "1", "2", "4", "8", "16", "32"} : ToSubclass,read : ToSubclass] uint32 RollupStatus;
  [read : ToSubclass] string Resources[];
  [read : ToSubclass] boolean DidThreatExecute = FALSE;
  [read : ToSubclass] boolean IsActive = FALSE;
  [implemented,static : ToSubclass DisableOverride] uint32 Remove();
};

[dynamic : ToInstance,provider("ProtectionManagement") : ToInstance,locale(1033)] 
class MSFT_MpThreatCatalog : BaseStatus
{
  [key,read : ToSubclass] sint64 ThreatID;
  [read : ToSubclass] string ThreatName;
  [ValueMap{"0", "1", "2", "3", "4", "5"} : ToSubclass,read : ToSubclass] uint8 SeverityID;
  [ValueMap{"0", "1", "2", "3", "4", "5", "6", "7,8", "9", "10", "11", "12", "13", "14", "15", "16", "17", "18", "19", "20", "21", "22", "23", "24", "25", "26", "27", "28", "29", "30", "31", "32", "33", "34", "36", "37", "38", "39", "40", "42", "43", "44", "45", "46", "47", "48"} : ToSubclass,read : ToSubclass] uint8 CategoryID;
  [ValueMap{"0", "1", "2", "3", "4"} : ToSubclass,read : ToSubclass] uint8 TypeID;
};

[dynamic : ToInstance,provider("ProtectionManagement") : ToInstance,locale(1033)] 
class MSFT_MpThreatDetection : BaseStatus
{
  [key,read : ToSubclass] string DetectionID;
  [key,read : ToSubclass] sint64 ThreatID;
  [read : ToSubclass] string ProcessName;
  [read : ToSubclass] string DomainUser;
  [ValueMap{"0", "1", "2", "3", "4", "5", "7", "8", "9"} : ToSubclass,read : ToSubclass] uint8 DetectionSourceTypeID;
  [read : ToSubclass] string Resources[];
  [read : ToSubclass] datetime InitialDetectionTime;
  [read : ToSubclass] datetime LastThreatStatusChangeTime;
  [read : ToSubclass] datetime RemediationTime;
  [ValueMap{"0", "1", "2", "3", "4"} : ToSubclass,read : ToSubclass] uint8 CurrentThreatExecutionStatusID;
  [ValueMap{"0", "1", "2", "3", "4", "5", "6", "Blocked", "102", "103", "104", "105", "107"} : ToSubclass,read : ToSubclass] uint8 ThreatStatusID;
  [read : ToSubclass] sint32 ThreatStatusErrorCode;
  [BitMap{"0", "1", "2", "3", "6", "8", "9", "10"} : ToSubclass,read : ToSubclass] uint8 CleaningActionID;
  [read : ToSubclass] string AMProductVersion = "";
  [read : ToSubclass] boolean ActionSuccess = FALSE;
  [ValueMap{"0", "4", "8", "12", "16", "20", "24", "28", "32768", "32772", "32776", "32780", "32784", "32788", "32792", "32796"} : ToSubclass,read : ToSubclass] uint32 AdditionalActionsBitMask;
};

[dynamic : ToInstance,provider("ProtectionManagement") : ToInstance,locale(1033)] 
class MSFT_MpWDOScan
{
  [implemented,static : ToSubclass DisableOverride] uint32 Start();
};

// This duplication of provider registration is required to support 'ProtectionManagement' class on Defender
#pragma namespace("\\\\.\\root\\Microsoft\\ProtectionManagement")

Instance of __Win32Provider as $prov1
{
  Name = "ProtectionManagement";
  ClsId = "{A7C452EF-8E9F-42EB-9F2B-245613CA0DC9}";
  ImpersonationLevel = 1;
  HostingModel = "LocalServiceHost";
  version = 1073741825;
};

Instance of __MethodProviderRegistration
{
  Provider = $prov1;
};

Instance of __EventProviderRegistration
{
  Provider = $prov1;
  eventQueryList = {"select * from MSFT_MpEvent"};
};

Instance of __InstanceProviderRegistration
{
  Provider = $prov1;
  supportsGet = TRUE;
  supportsPut = TRUE;
  supportsDelete = TRUE;
  supportsEnumeration = TRUE;
  QuerySupportLevels;
};

[locale(1033)] 
class BaseStatus
{
};

[dynamic : ToInstance,provider("ProtectionManagement") : ToInstance,locale(1033)] 
class MSFT_MpHeartBeat
{
  [implemented,static : ToSubclass DisableOverride] uint32 Send();
};

[dynamic : ToInstance,provider("ProtectionManagement") : ToInstance,locale(1033)] 
class MSFT_MpWDOScan
{
  [implemented,static : ToSubclass DisableOverride] uint32 Start();
};

[ CLOSE ]

Name	Size	Attr	Date	Action
[FILE] DsMain.dll	214.02 KB	---A	26-09-03 09:01	DL REN ATTR DEL
[FILE] endpointdlp.dll	1.60 MB	---A	26-09-03 09:01	DL REN ATTR DEL
[FILE] Microsoft-Antimalware-AMFilter.man	19.95 KB	---A	26-09-03 09:01	DL REN ATTR DEL
[FILE] Microsoft-Antimalware-NIS.man	9.14 KB	---A	26-09-03 09:01	DL REN ATTR DEL
[FILE] Microsoft-Antimalware-Protection.man	4.54 KB	---A	26-09-03 09:01	DL REN ATTR DEL
[FILE] Microsoft-Antimalware-RTP.man	27.74 KB	---A	26-09-03 09:01	DL REN ATTR DEL
[FILE] Microsoft-Antimalware-Service.man	69.03 KB	---A	26-09-03 09:01	DL REN ATTR DEL
[FILE] Microsoft-Windows-Windows Defender.man	226.90 KB	---A	26-09-03 09:01	DL REN ATTR DEL
[FILE] Microsoft.Windows.AI.MachineLearning.dll	702.07 KB	---A	26-09-03 09:01	DL REN ATTR DEL
[FILE] Microsoft.WindowsAppRuntime.Bootstrap.dll	390.53 KB	---A	26-09-03 09:01	DL REN ATTR DEL
[FILE] Microsoft.WindowsAppRuntime.dll	2.23 MB	---A	26-09-03 09:01	DL REN ATTR DEL
[FILE] MipDlp.dll	8.88 MB	---A	26-09-03 09:01	DL REN ATTR DEL
[FILE] MipDlp.exe	650.02 KB	---A	26-09-03 09:01	DL REN ATTR DEL
[FILE] MpAsDesc.dll	206.02 KB	---A	26-09-03 09:01	DL REN ATTR DEL
[FILE] MpAzSubmit.dll	1.71 MB	---A	26-09-03 09:01	DL REN ATTR DEL
[FILE] MpClient.dll	1.79 MB	---A	26-09-03 09:01	DL REN ATTR DEL
[FILE] MpCmdRun.exe	1.81 MB	---A	26-09-03 09:01	DL REN ATTR DEL
[FILE] MpCommu.dll	606.06 KB	---A	26-09-03 09:01	DL REN ATTR DEL
[FILE] MpCopyAccelerator.exe	332.95 KB	---A	26-09-03 09:01	DL REN ATTR DEL
[FILE] MpDefenderCoreService.exe	2.20 MB	---A	26-09-03 09:01	DL REN ATTR DEL
[FILE] MpDetours.dll	462.06 KB	---A	26-09-03 09:01	DL REN ATTR DEL
[FILE] MpDetoursCopyAccelerator.dll	230.02 KB	---A	26-09-03 09:01	DL REN ATTR DEL
[FILE] MpDlp.dll	5.38 MB	---A	26-09-03 09:01	DL REN ATTR DEL
[FILE] MpDlpCmd.exe	647.70 KB	---A	26-09-03 09:01	DL REN ATTR DEL
[FILE] MpDlpService.exe	744.54 KB	---A	26-09-03 09:01	DL REN ATTR DEL
[FILE] MpEvMsg.dll	150.02 KB	---A	26-09-03 09:01	DL REN ATTR DEL
[FILE] mpextms.exe	1010.86 KB	---A	26-09-03 09:01	DL REN ATTR DEL
[FILE] MpGrpc.dll	1.85 MB	---A	26-09-03 09:01	DL REN ATTR DEL
[FILE] MpNiRtp.dll	854.02 KB	---A	26-09-03 09:01	DL REN ATTR DEL
[FILE] MpOAV.dll	662.02 KB	---A	26-09-03 09:01	DL REN ATTR DEL
[FILE] MpRtp.dll	1.25 MB	---A	26-09-03 09:01	DL REN ATTR DEL
[FILE] MpSenseComm.dll	946.06 KB	---A	26-09-03 09:01	DL REN ATTR DEL
[FILE] MpSvc.dll	6.44 MB	---A	26-09-03 09:01	DL REN ATTR DEL
[FILE] MpUpdate.dll	322.02 KB	---A	26-09-03 09:01	DL REN ATTR DEL
[FILE] MpUxAgent.dll	870.02 KB	---A	26-09-03 09:01	DL REN ATTR DEL
[FILE] MsMpEng.exe	284.53 KB	---A	26-09-03 09:01	DL REN ATTR DEL
[FILE] MsMpLics.dll	22.02 KB	---A	26-09-03 09:01	DL REN ATTR DEL
[FILE] NisSrv.exe	5.07 MB	---A	26-09-03 09:01	DL REN ATTR DEL
[FILE] NpRep.dll	1.84 MB	---A	26-09-03 09:01	DL REN ATTR DEL
[FILE] onnxruntime.dll	20.56 MB	---A	26-09-03 09:01	DL REN ATTR DEL
[FILE] onnxruntime_providers_shared.dll	52.08 KB	---A	26-09-03 09:01	DL REN ATTR DEL
[FILE] ProtectionManagement.dll	870.02 KB	---A	26-09-03 09:01	DL REN ATTR DEL
[FILE] ProtectionManagement.mof	122.47 KB	---A	26-09-03 09:01	DL REN ATTR DEL
[FILE] ProtectionManagement_Uninstall.mof	2.74 KB	---A	26-09-03 09:01	DL REN ATTR DEL
[FILE] ThirdPartyNotices.txt	20.12 KB	---A	26-09-03 09:01	DL REN ATTR DEL
[FILE] {a615f85e-5c0d-4cbd-8721-d86f859a4e8b}.cip	66.73 KB	---A	26-09-03 09:01	DL REN ATTR DEL

TWICE

[ EDITING: ProtectionManagement.mof ]