Defender’s hidden flight recorder: decrypting mpenginedb.db

Researchers have discovered that Microsoft Defender maintains an encrypted SQLite database called MetaVault at mpenginedb.db, functioning as a flight recorder for recent security context and threat tracking. The database is encrypted using weak RC4 ciphers with a fixed key tied to the engine build rather than the individual machine, allowing investigators to reconstruct the key directly from evidence files. To assist in parsing this hidden artifact, the authors released a standalone Python parser, a PowerShell decoding script, and an SQLECmd map. Open article →