MpSvc.dll RPC interfaces

запчасть от Windows Defender
Висит на автогенеренном ALPC port с префиксом IMpService
IMpService C503F532-443A-4C69-8300-CCD1FBDB3839 version 1.0
0x30 methods:

• ServerMpEnableFeature
• ServerMpDisableFeature
• ServerMpFeatureQueryStatus
• ServerMpEventOpen
• ServerMpEventClose
• ServerMpEventQueryNotification
• ServerMpOnDemandStartScan
• ServerMpOnDemandQueryNotification
• ServerMpOnDemandQueryScanResult
• ServerMpOnDemandCancelScan
• ServerMpOnDemandPauseScan
• ServerMpOnDemandResumeScan
• ServerMpOnDemandPersistScan
• ServerMpOnDemandOpenScan
• ServerMpOnDemandCloseScan
• ServerMpOnDemandThreatOpen
• ServerMpOnDemandThreatEnum
• ServerMpOnDemandThreatClose
• ServerMpScanOpenHistory
• ServerMpScanEnumerateHistory
• ServerMpScanCloseHistory
• ServerMpScanDeleteHistory
• ServerMpScanCleanOpen
• ServerMpScanCleanClose
• ServerMpScanCleanSetAction
• ServerMpScanCleanPrecheck
• ServerMpScanCleanPrecheckNotification
• ServerMpScanCleanThreats
• ServerMpScanCleanThreatsNotification
• ServerMpScanCleanQueryInfo
• ServerMpQuarantineEnumOpen
• ServerMpQuarantineEnumerate
• ServerMpQuarantineEnumClose
• ServerMpQuarantineQueryInfo
• ServerMpQuarantineRestoreThreat - вот этот метод кажется мне особенно многообещающим :-)
• ServerMpQuarantineDeleteThreat
• ServerMpQueryEngineVersion
• ServerMpUpdateEngineSignature
• ServerMpRollbackEngineSignature
• ServerMpScanGenerateReport
• ServerMpThreatStaticInfo
• ServerMpQuerySystemInfo
• ServerMpRpcConfigSetValue
• ServerMpRpcConfigDelValue
• ServerMpRpcElevationHandleOpen
• ServerMpRpcElevationHandleAttach
• ServerMpRpcElevationHandleClose
• ServerMpRpcElevateCleanHandle