Microsoft Defender for endpoint Binaries

Question

What are all the binaries related with the functionality of Microsoft Defender for Endpoint. I need to track the utilization of resources for devices onboarded to Defender for Endpoint, but I need to know all related binaries that are used for Defender for endpoint. I have looked throughout the learn pages and was unable to find any source that directly correlates what binaries perform what function.

Answer 1

Dear @Alkazak, Khalid

For this scenario, I would approach the process mapping by looking at the Defender for Endpoint components documented by Microsoft rather than treating every executable as a standalone feature.

For current Windows versions, the main MDE sensor processes include:

• MsSense.exe
• SenseCncProxy.exe
• SenseSampleUploader.exe
• SenseIR.exe
• SenseCM.exe
• SenseNdr.exe
• SenseCE.exe
• SenseTVM.exe
• SenseTracer.exe
• SenseDlpProcessor.exe

These processes are part of the Defender for Endpoint sensor and its supporting components. The exact set can vary depending on the Windows version, Defender platform version, and the capabilities enabled on the device.

It is also useful to distinguish the MDE sensor from the other Microsoft Defender components running on the endpoint.

For Microsoft Defender Antivirus, the relevant processes include:

• MsMpEng.exe
• NisSrv.exe
• MpDefenderCoreService.exe
• MpCmdRun.exe
• For Endpoint DLP, you may additionally encounter:
• MpDlpService.exe
• MpDlpCmd.exe
• MipDlp.exe
• DlpUserAgent.exe

For resource monitoring, I would group these into three categories:

MDE sensor: MsSense.exe and the documented Sense*.exe components

Defender Antivirus: MsMpEng.exe, NisSrv.exe, MpDefenderCoreService.exe, etc.

Endpoint DLP: MpDlp*, MipDlp.exe, and DlpUserAgent.exe

This makes it easier to correlate CPU, memory, disk, and network utilization with the relevant security component.

There are also platform-specific differences. For example, Windows Server 2016 and Windows Server 2012 R2 using the modern unified solution can have the MDE binaries under the Microsoft\Windows Defender Advanced Threat Protection\Platform directory. Older supported platforms use a different process model based on the Microsoft Monitoring Agent.

When building the monitoring solution, I would use the documented process names as the initial inventory and correlate them with the installed Defender platform version rather than relying exclusively on hard-coded executable paths.

For detailed performance analysis, the Defender performance analyzer and the MDE Client Analyzer are also useful, as they provide additional context when investigating Defender-related resource consumption.

For your use case, I would make MsSense.exe and the documented Sense*.exe components the primary focus for measuring the MDE sensor footprint, while monitoring MsMpEng.exe and the other Defender components separately to understand the overall security stack resource consumption.

---

If this answers your query, please click Accept Answer and Upvote if you found it helpful. If you have any further questions, feel free to let us know.

Answer 2

The available documentation in this context does not provide a single authoritative mapping of each Microsoft Defender for Endpoint binary to its exact function.

What is documented is the set of Windows client processes and paths that are associated with Defender for Endpoint functionality and commonly used for exclusions or connectivity validation.

For Windows 11, Windows 10 version 1803 or later, Windows Server 2025, Windows Server 2022, Windows Server 2019, Windows Server 2016/2012 R2 with the modern unified solution, the documented binaries and paths are:

• EDR-related processes and paths:
  • C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
  • C:\Program Files\Windows Defender Advanced Threat Protection\SenseCncProxy.exe
  • C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe
  • C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe
  • C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe
  • C:\Program Files\Windows Defender Advanced Threat Protection\SenseNdr.exe
  • C:\Program Files\Windows Defender Advanced Threat Protection\Classification\SenseCE.exe
  • C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\DataCollection
  • C:\Program Files\Windows Defender Advanced Threat Protection\SenseTVM.exe
  • C:\Program Files\Windows Defender Advanced Threat Protection\SenseTracer.exe
  • C:\Program Files\Windows Defender Advanced Threat Protection\SenseDlpProcessor.exe
  • Registry path: HKLM\SOFTWARE\Microsoft\Windows Advanced Threat Protection\*
• Antivirus-related processes documented alongside Defender for Endpoint requirements:
  • C:\Program Files\Windows Defender\MsMpEng.exe
  • C:\Program Files\Windows Defender\NisSrv.exe
  • C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe
  • C:\Program Files\Windows Defender\MpCmdRun.exe
  • C:\Program Files\Windows Defender\MpDefenderCoreService.exe
  • C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.*\MsMpEng.exe
  • C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.*\NisSrv.exe
  • C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.*\ConfigSecurityPolicy.exe
  • C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.*\MpCopyAccelerator.exe
  • C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.*\MpCmdRun.exe
  • C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.*\MpDefenderCoreService.exe
  • C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.*\mpextms.exe
• Endpoint DLP-related processes documented alongside Defender for Endpoint requirements:
  • C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.*\MpDlpService.exe
  • C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.*\MpDlpCmd.exe
  • C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.*\MipDlp.exe
  • C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.*\DlpUserAgent.exe

For Windows Server 2016 or Windows Server 2012 R2 running the modern unified solution, after KB5005292, these additional EDR component paths are documented:

• C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\*\MsSense.exe
• C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\*\SenseCnCProxy.exe
• C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\*\SenseIR.exe
• C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\*\SenseCE.exe
• C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\*\SenseSampleUploader.exe
• C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\*\SenseCM.exe
• C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\DataCollection
• C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\*\SenseTVM.exe

For older platforms such as Windows 8.1, Windows 7, and Windows Server 2008 R2 SP1, the documented processes are:

• C:\Program Files\Microsoft Monitoring Agent\Agent\Health Service State\Monitoring Host Temporary Files 6\45\MsSenseS.exe
• C:\Program Files\Microsoft Monitoring Agent\Agent\AgentControlPanel.exe
• C:\Program Files\Microsoft Monitoring Agent\Agent\HealthService.exe
• C:\Program Files\Microsoft Monitoring Agent\Agent\HSLockdown.exe
• C:\Program Files\Microsoft Monitoring Agent\Agent\MOMPerfSnapshotHelper.exe
• C:\Program Files\Microsoft Monitoring Agent\Agent\MonitoringHost.exe
• C:\Program Files\Microsoft Monitoring Agent\Agent\TestCloudConnection.exe

If the goal is resource tracking, the most directly relevant Defender for Endpoint-specific binaries in the documented EDR set are the Sense* processes and MsSense.exe. The context also shows that SenseTVM.exe is part of the Defender for Endpoint component set, and the broader Defender platform can also involve Microsoft Defender Antivirus and Endpoint DLP binaries on onboarded devices.

The context does not provide an official per-binary function map beyond the category labels shown above: EDR exclusions, Antivirus exclusions, and Endpoint DLP exclusions.

---

• Migrate to Microsoft Defender for Endpoint - Phase 2: Setup
• Microsoft Defender for Endpoint standard connectivity URLs - commercial
• Microsoft Defender for Endpoint streamlined connectivity URLs - commercial
• Microsoft Defender for Endpoint overview