<?xml version='1.0' encoding='utf-8' standalone='yes'?>
<assembly
    xmlns="urn:schemas-microsoft-com:asm.v3"
    xmlns:xsd="http://www.w3.org/2001/XMLSchema"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    manifestVersion="1.0"
    >
  <assemblyIdentity
      buildType="$(build.buildType)"
      language="neutral"
      name="Windows-Defender-Drivers"
      processorArchitecture="$(build.arch)"
      publicKeyToken="$(Build.WindowsPublicKeyToken)"
      version="$(build.version)"
      versionScope="nonSxS"
      />
  <!--
      ***********************************************************************************************************
          Driver files
      ***********************************************************************************************************
      -->
  <file
      buildFilter="not $(build.buildFilterIsWow)"
      destinationPath="$(runtime.drivers)"
      importPath="$(build.campBinaryImportPath)"
      name="WdFilter.sys"
      sourceName="WdFilter.sys"
      sourcePath=".\"
      />
  <file
      buildFilter="not $(build.buildFilterIsWow)"
      destinationPath="$(runtime.drivers)"
      importPath="$(build.campBinaryImportPath)"
      name="WdBoot.sys"
      sourceName="WdBoot.sys"
      sourcePath=".\"
      />
  <file
      buildFilter="not $(build.buildFilterIsWow)"
      destinationPath="$(runtime.drivers)"
      importPath="$(build.campBinaryImportPath)"
      name="WdDevFlt.sys"
      sourceName="WdDevFlt.sys"
      sourcePath=".\"
      />
  <file
      buildFilter="not $(build.buildFilterIsWow) and (build.arch = amd64 or build.arch = x86)"
      destinationPath="$(runtime.drivers)"
      importPath="$(build.campBinaryImportPath)"
      name="KslD.sys"
      sourceName="KslD.sys"
      sourcePath=".\"
      />
  <file
      buildFilter="not $(build.buildFilterIsWow)"
      destinationPath="$(runtime.drivers)"
      importPath="$(build.campBinaryImportPath)"
      name="WdAiNisDrv.sys"
      sourceName="WdAiNisDrv.sys"
      sourcePath=".\"
      />
  <!--
    ***********************************************************************************************************
        BEGIN MEMBERSHIPS SECTION 
    ***********************************************************************************************************
    -->
  <memberships buildFilter="not $(build.buildFilterIsWow)">
    <!--
      ***********************************************************************************************************
          Mark component BootRecovery to allow files to be backed up
          in WinSxS\backup to recover from corruption, and BootCritical for
          the boot start mini filter.
      ***********************************************************************************************************
        -->
    <categoryMembership>
      <id
          name="Microsoft.Windows.Categories"
          publicKeyToken="365143bb27e7ac8b"
          typeName="BootRecovery"
          version="1.0.0.0"
          />
    </categoryMembership>
    <categoryMembership>
      <id
          name="Microsoft.Windows.Categories"
          publicKeyToken="365143bb27e7ac8b"
          typeName="BootCritical"
          version="1.0.0.0"
          />
    </categoryMembership>
    <!--
      ***********************************************************************************************************
          BEGIN SERVICE AND DRIVER CONFIGURATION SECTION 
      ***********************************************************************************************************
        -->
    <categoryMembership>
      <id
          name="Microsoft.Windows.Categories.Services"
          publicKeyToken="$(build.WindowsPublicKeyToken)"
          typeName="Service"
          version="1.0.0.0"
          />
      <!--
        ***********************************************************************************************************
            File system mini filter driver
        ***********************************************************************************************************
        -->
      <categoryInstance>
        <serviceData
            dependOnService="FltMgr"
            description="@%ProgramFiles%\Windows Defender\MpAsDesc.dll,-340"
            displayName="@%ProgramFiles%\Windows Defender\MpAsDesc.dll,-330"
            errorControl="normal"
            group="FSFilter Anti-Virus"
            imagePath="system32\drivers\WdFilter.sys"
            name="WdFilter"
            start="boot"
            startAfterInstall="asynchronous"
            type="fileSystemDriver"
            >
          <securityDescriptor name="DefenderDriversSD"/>
        </serviceData>
      </categoryInstance>
      <!--
        ***********************************************************************************************************
            Early boot driver
        ***********************************************************************************************************
        -->
      <categoryInstance>
        <serviceData
            description="@%ProgramFiles%\Windows Defender\MpAsDesc.dll,-400"
            displayName="@%ProgramFiles%\Windows Defender\MpAsDesc.dll,-390"
            errorControl="normal"
            group="Early-Launch"
            imagePath="system32\drivers\WdBoot.sys"
            name="WdBoot"
            start="boot"
            startAfterInstall="none"
            type="kernelDriver"
            >
          <securityDescriptor name="DefenderDriversSD"/>
        </serviceData>
      </categoryInstance>
      <!--
        ***********************************************************************************************************
            WD AI NIS Driver
        ***********************************************************************************************************
        -->
      <categoryInstance>
        <serviceData
            dependOnService="BFE"
            description="@%ProgramFiles%\Windows Defender\MpAsDesc.dll,-440"
            displayName="@%ProgramFiles%\Windows Defender\MpAsDesc.dll,-430"
            errorControl="normal"
            imagePath="system32\drivers\WdAiNisDrv.sys"
            name="WdAiNisDrv"
            start="demand"
            startAfterInstall="none"
            type="kernelDriver"
            >
          <securityDescriptor name="DefenderDriversSD"/>
        </serviceData>
      </categoryInstance>
    </categoryMembership>
  </memberships>
  <!--
    ***********************************************************************************************************
        BEGIN CONFIGURATION REGISTRY KEYS SECTION 
    ***********************************************************************************************************
    -->
  <registryKeys>
    <!--
      ***********************************************************************************************************
          File system mini filter driver keys
      ***********************************************************************************************************
      -->
    <registryKey
        buildFilter="not $(build.buildFilterIsWow)"
        keyName="HKEY_LOCAL_MACHINE\System\CurrentControlset\Services\WdFilter\Instances"
        >
      <registryValue
          name="DefaultInstance"
          value="WdFilter Instance"
          valueType="REG_SZ"
          />
    </registryKey>
    <registryKey
        buildFilter="not $(build.buildFilterIsWow)"
        keyName="HKEY_LOCAL_MACHINE\System\CurrentControlset\Services\WdFilter\Instances\WdFilter Instance"
        >
      <registryValue
          name="Altitude"
          value="328010"
          valueType="REG_SZ"
          />
      <registryValue
          name="Flags"
          value="0"
          valueType="REG_DWORD"
          />
    </registryKey>
    <registryKey
        buildFilter="not $(build.buildFilterIsWow)"
        keyName="HKEY_LOCAL_MACHINE\System\CurrentControlset\Services\WdFilter"
        >
      <registryValue
          name="SupportedFeatures"
          value="0xF"
          valueType="REG_DWORD"
          />
    </registryKey>
    <!--
      ***********************************************************************************************************
          ELAM driver keys and values
      ***********************************************************************************************************
      -->
    <registryKey
        buildFilter="not $(build.buildFilterIsWow)"
        keyName="HKEY_LOCAL_MACHINE\System\CurrentControlset\Services\WdBoot"
        >
      <registryValue
          name="SupportElamHive"
          value="0"
          valueType="REG_DWORD"
          />
    </registryKey>
  </registryKeys>
  <instrumentation>
    <events
        xmlns="http://schemas.microsoft.com/win/2004/08/events"
        xmlns:win="http://manifests.microsoft.com/win/2004/08/windows/events"
        >
      <provider
          guid="{cfeb0608-330e-4410-b00d-56d8da9986e6}"
          message="$(string.Microsoft-Antimalware-AMFilter.provider.name)"
          messageFileName="%windir%\system32\drivers\WdFilter.sys"
          name="Microsoft-Antimalware-AMFilter"
          resourceFileName="%windir%\system32\drivers\WdFilter.sys"
          symbol="Microsoft_Antimalware_AMFilter"
          >
        <tasks>
          <task
              eventGUID="{c1c40073-feee-4bad-bbd8-432809e7321b}"
              name="AMFilter_CacheFlush"
              value="1"
              />
          <task
              eventGUID="{fd2dd5d6-d0ae-4a27-b81f-65cee630d427}"
              name="AMFilter_CacheRemove"
              value="2"
              />
          <task
              eventGUID="{f4b8837c-cbbc-4465-b67f-7c1dc7b0254f}"
              name="AMFilter_CacheHit"
              value="3"
              />
          <task
              eventGUID="{9aaa2163-02a1-411c-b86b-e39f6736ea8f}"
              name="AMFilter_CacheMiss"
              value="4"
              />
          <task
              eventGUID="{bbb3c641-850d-43e2-bf03-1ab1464a19bd}"
              name="AMFilter_CacheAdd"
              value="5"
              />
          <task
              eventGUID="{4aaa2e11-d313-4b4d-a0ce-c870c77ba4e9}"
              name="AMFilter_SeqReadFlag"
              value="6"
              />
          <task
              eventGUID="{09a0abb6-f30e-4004-8a64-a421c73a8fdc}"
              name="AMFilter_TrustedProcess"
              value="7"
              />
          <task
              eventGUID="{7d5e421d-75b3-4c51-ad8c-9d56967a8004}"
              name="AMFilter_ProcessContext"
              value="8"
              />
          <task
              eventGUID="{9fb4677d-ce50-4e86-a0d5-02fe5099a29d}"
              name="AMFilter_FileScan"
              value="9"
              />
          <task
              eventGUID="{1ca41536-fbf1-4194-838c-a84ba1ca2e2f}"
              name="AMFilter_DeleteStreamContext"
              value="10"
              />
          <task
              eventGUID="{f569b04c-d7e0-4802-8b7e-8b5a45385a72}"
              name="AMFilter_FileScanResult"
              value="11"
              />
        </tasks>
        <templates>
          <template tid="FileIDPayload">
            <data
                inType="win:UInt64"
                name="File_ID"
                />
          </template>
          <template tid="TrustedProcessPayload">
            <data
                inType="win:UInt32"
                name="Pid"
                />
            <data
                inType="win:UnicodeString"
                name="Reason"
                />
            <data
                inType="win:UInt32"
                name="Trusted"
                />
            <data
                inType="win:UInt32"
                name="TotalTrusted"
                />
            <data
                inType="win:UInt32"
                name="TotalUntrusted"
                />
            <data
                inType="win:UnicodeString"
                name="Path"
                />
          </template>
          <template tid="ProcessContextPayload">
            <data
                inType="win:UInt32"
                name="Pid"
                />
            <data
                inType="win:UnicodeString"
                name="Reason"
                />
            <data
                inType="win:UInt32"
                name="Flags"
                outType="win:HexInt32"
                />
            <data
                inType="win:UInt32"
                name="ProcessFilterFlags"
                outType="win:HexInt32"
                />
            <data
                inType="win:UnicodeString"
                name="ProcessName"
                />
            <data
                inType="win:UInt64"
                name="VmHardenType"
                outType="win:HexInt64"
                />
            <data
                inType="win:UInt64"
                name="ExemptVmHardenedTypes"
                outType="win:HexInt64"
                />
          </template>
          <template tid="FileScanPayload">
            <data
                inType="win:UnicodeString"
                name="FileName"
                outType="xsd:string"
                />
            <data
                inType="win:UnicodeString"
                name="Reason"
                outType="xsd:string"
                />
            <data
                inType="win:UInt64"
                name="IoStatusBlockForNewFile"
                outType="win:HexInt64"
                />
          </template>
          <template tid="FileScanResultPayload">
            <data
                inType="win:UnicodeString"
                name="FileName"
                outType="xsd:string"
                />
            <data
                inType="win:UInt32"
                name="Reason"
                />
            <data
                inType="win:UInt32"
                name="ScanStatus"
                outType="win:HexInt32"
                />
            <data
                inType="win:UInt32"
                name="State"
                />
            <data
                inType="win:UInt32"
                name="ScanAttributes"
                outType="win:HexInt32"
                />
            <data
                inType="win:UInt64"
                name="FileId"
                outType="win:HexInt64"
                />
            <data
                inType="win:UInt64"
                name="USN"
                outType="win:HexInt64"
                />
          </template>
        </templates>
        <events>
          <event
              keywords="Cache"
              level="win:Informational"
              opcode="win:Info"
              symbol="AMFilter_CacheFlushEvent"
              task="AMFilter_CacheFlush"
              value="1"
              version="0"
              />
          <event
              keywords="Cache"
              level="win:Verbose"
              opcode="win:Info"
              symbol="AMFilter_CacheRemoveEvent"
              task="AMFilter_CacheRemove"
              template="FileIDPayload"
              value="2"
              version="0"
              />
          <event
              keywords="Cache"
              level="win:Verbose"
              opcode="win:Info"
              symbol="AMFilter_CacheHitEvent"
              task="AMFilter_CacheHit"
              template="FileIDPayload"
              value="3"
              version="0"
              />
          <event
              keywords="Cache"
              level="win:Verbose"
              opcode="win:Info"
              symbol="AMFilter_CacheMissEvent"
              task="AMFilter_CacheMiss"
              template="FileIDPayload"
              value="4"
              version="0"
              />
          <event
              keywords="Cache"
              level="win:Verbose"
              opcode="win:Info"
              symbol="AMFilter_CacheAddEvent"
              task="AMFilter_CacheAdd"
              template="FileIDPayload"
              value="5"
              version="0"
              />
          <event
              keywords="IoBehavior"
              level="win:Informational"
              opcode="win:Info"
              symbol="AMFilter_SeqReadFlagEvent"
              task="AMFilter_SeqReadFlag"
              value="6"
              version="0"
              />
          <event
              keywords="TrustedProcess"
              level="win:Informational"
              opcode="win:Info"
              symbol="AMFilter_TrustedProcessEvent"
              task="AMFilter_TrustedProcess"
              template="TrustedProcessPayload"
              value="7"
              version="0"
              />
          <event
              keywords="ProcessContext"
              level="win:Informational"
              opcode="win:Info"
              symbol="AMFilter_ProcessContextEvent"
              task="AMFilter_ProcessContext"
              template="ProcessContextPayload"
              value="8"
              version="0"
              />
          <event
              keywords="FileScan"
              level="win:Informational"
              opcode="win:Info"
              symbol="AMFilter_FileScanEvent"
              task="AMFilter_FileScan"
              template="FileScanPayload"
              value="9"
              version="0"
              />
          <event
              keywords="StreamContext"
              level="win:Verbose"
              opcode="win:Info"
              symbol="AMFilter_DeleteStreamContextEvent"
              task="AMFilter_DeleteStreamContext"
              template="FileIDPayload"
              value="10"
              version="0"
              />
          <event
              keywords="FileScan"
              level="win:Informational"
              opcode="win:Info"
              symbol="AMFilter_FileScanResultEvent"
              task="AMFilter_FileScanResult"
              template="FileScanResultPayload"
              value="11"
              version="0"
              />
        </events>
        <keywords>
          <keyword
              mask="0x1"
              name="FileScan"
              symbol="FileScanKeyword"
              />
          <keyword
              mask="0x2"
              name="ProcessContext"
              symbol="ProcessContextKeyword"
              />
          <keyword
              mask="0x4"
              name="Cache"
              symbol="CacheKeyword"
              />
          <keyword
              mask="0x8"
              name="TrustedProcess"
              symbol="TrustedProcessKeyword"
              />
          <keyword
              mask="0x10"
              name="IoBehavior"
              symbol="IoBehaviorKeyword"
              />
          <keyword
              mask="0x20"
              name="StreamContext"
              symbol="StreamContextKeyword"
              />
        </keywords>
      </provider>
    </events>
  </instrumentation>
  <localization>
    <resources culture="en-US">
      <stringTable>
        <string
            id="Microsoft-Antimalware-AMFilter.provider.name"
            value="Microsoft-Antimalware-AMFilter"
            />
      </stringTable>
    </resources>
  </localization>
  <trustInfo>
    <security>
      <accessControl>
        <securityDescriptorDefinitions>
          <securityDescriptorDefinition
              name="DefenderDriversSD"
              sddl="D:(A;;GA;;;S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464)(A;OICIIO;GA;;;S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRRCWDWO;;;BA)(A;;CCLCSWRPLOCRRC;;;IU)(A;;CCLCSWRPLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
              />
        </securityDescriptorDefinitions>
      </accessControl>
    </security>
  </trustInfo>
</assembly>