The magic sauce that’s is their IP I guess, I’m saying. Tbh I’ve not looked into the scan engine in any great detail, but there are resource hacker tools out there that can derive a lot of information for a .exe. I know @Aaron Parker did some work scanning directories for exes and picking those up to add to a rule. Can you not approach MS?