Defender mpenginedb MetaVault Decryption and Forensic Analysis

Microsoft Defender maintains a hidden internal SQLite database known as MetaVault (mpenginedb.db) that acts as a 'flight recorder' for endpoint activity. Researchers from Protokol-7 discovered that while this database is encrypted to prevent standard forensic tools from parsing it, the encryption uses a weak RC4 implementation with a fixed 256-byte key tied to the engine build rather than the specific machine. This vulnerability allows investigators to decrypt the database and recover the key directly from the evidence files by exploiting zero-filled space in SQLite pages.

The database contains high-fidelity telemetry that often persists for two weeks, even if original files or system logs (like Sysmon or Amcache) are deleted by an attacker. It tracks process execution, file creation context, and internal attack scoring mapped to MITRE ATT&CK techniques. Because standard tools like SQLECmd skip these files due to encrypted headers, this artifact has largely been overlooked in historical incident response engagements.

This discovery is highly significant for SOC teams and forensic investigators. It provides a way to verify Tamper Protection states, identify unsigned PE creation, and correlate file modifications using recovered USN Journal values. The ability to derive the decryption key from the file itself ensures that analysis remains possible across different Defender engine builds without requiring access to the original host's memory or specific DLLs.