// DefenderRuleParser // Author: Andrea Cristaldi 2025 - https://github.com/andreacristaldi/DefenderRuleParser // This project is licensed under the Apache 2.0 License. using System; using System.Collections.Generic; namespace DefenderRuleParser2 { public static class SignatureTypeMapper { private static readonly Dictionary SignatureTypeMap = new Dictionary { [0x5C] = "SIGNATURE_TYPE_THREAT_BEGIN", [0x5D] = "SIGNATURE_TYPE_THREAT_END", //[0x68] = "SIGNATURE_TYPE_FNAME", //[0x69] = "SIGNATURE_TYPE_CATEGORY", //[0x6A] = "SIGNATURE_TYPE_NAME", // Common signature types [0x61] = "SIGNATURE_TYPE_PEHSTR", [0x78] = "SIGNATURE_TYPE_PEHSTR_EXT", [0x62] = "SIGNATURE_TYPE_LOCALHASH", [0x67] = "SIGNATURE_TYPE_STATIC", [0x63] = "SIGNATURE_TYPE_REGKEY", [0x5F] = "SIGNATURE_TYPE_FILEPATH", [0x5E] = "SIGNATURE_TYPE_FILENAME", [0x60] = "SIGNATURE_TYPE_FOLDERNAME", [0x51] = "SIGNATURE_TYPE_PATTMATCH", [0x77] = "SIGNATURE_TYPE_PATTMATCH_V2", [0x79] = "SIGNATURE_TYPE_VDLL_X86", [0x7A] = "SIGNATURE_TYPE_LUASTANDALONE", // Additional [0x11] = "SIGNATURE_TYPE_CKOLDREC", [0x1C] = "SIGNATURE_TYPE_RESERVED", [0x20] = "SIGNATURE_TYPE_KVIR32", [0x21] = "SIGNATURE_TYPE_POLYVIR32", [0x27] = "SIGNATURE_TYPE_NSCRIPT_NORMAL", [0x28] = "SIGNATURE_TYPE_NSCRIPT_SP", [0x29] = "SIGNATURE_TYPE_NSCRIPT_BRUTE", [0x2C] = "SIGNATURE_TYPE_NSCRIPT_CURE", [0x30] = "SIGNATURE_TYPE_TITANFLT", [0x32] = "SIGNATURE_TYPE_MACROHSTR_EXT", [0x3D] = "SIGNATURE_TYPE_PEFILE_CURE", [0x3E] = "SIGNATURE_TYPE_MAC_CURE", [0x40] = "SIGNATURE_TYPE_SIGTREE", [0x41] = "SIGNATURE_TYPE_SIGTREE_EXT", [0x42] = "SIGNATURE_TYPE_MACRO_PCODE", [0x43] = "SIGNATURE_TYPE_MACRO_SOURCE", [0x44] = "SIGNATURE_TYPE_BOOT", [0x49] = "SIGNATURE_TYPE_CLEANSCRIPT", [0x50] = "SIGNATURE_TYPE_CKSIMPLEREC", [0x53] = "SIGNATURE_TYPE_RPFROUTINE", [0x55] = "SIGNATURE_TYPE_NID", [0x56] = "SIGNATURE_TYPE_GENSFX", [0x57] = "SIGNATURE_TYPE_UNPLIB", [0x58] = "SIGNATURE_TYPE_DEFAULTS", [0x5B] = "SIGNATURE_TYPE_DBVAR", [0x5C] = "SIGNATURE_TYPE_THREAT_BEGIN", [0x6A] = "SIGNATURE_TYPE_REMOVAL_POLICY", [0x7A] = "SIGNATURE_TYPE_VERSIONCHECK", [0x7B] = "SIGNATURE_TYPE_SAMPLE_REQUEST", [0x7C] = "SIGNATURE_TYPE_VDLL_X64", [0x7E] = "SIGNATURE_TYPE_SNID", [0x7F] = "SIGNATURE_TYPE_FOP", [0x80] = "SIGNATURE_TYPE_KCRCE", [0x83] = "SIGNATURE_TYPE_VFILE", [0x84] = "SIGNATURE_TYPE_SIGFLAGS", [0x85] = "SIGNATURE_TYPE_PEHSTR_EXT2", [0x86] = "SIGNATURE_TYPE_PEMAIN_LOCATOR", [0x87] = "SIGNATURE_TYPE_PESTATIC", [0x88] = "SIGNATURE_TYPE_UFSP_DISABLE", [0x89] = "SIGNATURE_TYPE_FOPEX", [0x8A] = "SIGNATURE_TYPE_PEPCODE", [0x8B] = "SIGNATURE_TYPE_IL_PATTERN", [0x8C] = "SIGNATURE_TYPE_ELFHSTR_EXT", [0x8D] = "SIGNATURE_TYPE_MACHOHSTR_EXT", [0x8E] = "SIGNATURE_TYPE_DOSHSTR_EXT", [0x8F] = "SIGNATURE_TYPE_MACROHSTR_EXT", [0x90] = "SIGNATURE_TYPE_TARGET_SCRIPT_PCODE", [0x91] = "SIGNATURE_TYPE_VDLL_IA64", [0x95] = "SIGNATURE_TYPE_PEBMPAT", [0x96] = "SIGNATURE_TYPE_AAGGREGATOR", [0x97] = "SIGNATURE_TYPE_SAMPLE_REQUEST_BY_NAME", [0x98] = "SIGNATURE_TYPE_REMOVAL_POLICY_BY_NAME", [0x99] = "SIGNATURE_TYPE_TUNNEL_X86", [0x9A] = "SIGNATURE_TYPE_TUNNEL_X64", [0x9B] = "SIGNATURE_TYPE_TUNNEL_IA64", [0x9C] = "SIGNATURE_TYPE_VDLL_ARM", [0x9E] = "SIGNATURE_TYPE_THREAD_X64", [0x9F] = "SIGNATURE_TYPE_THREAD_IA64", [0xA0] = "SIGNATURE_TYPE_FRIENDLYFILE_SHA256", [0xA1] = "SIGNATURE_TYPE_FRIENDLYFILE_SHA512", [0xA2] = "SIGNATURE_TYPE_SHARED_THREAT", [0xA3] = "SIGNATURE_TYPE_VDM_METADATA", [0xA4] = "SIGNATURE_TYPE_VSTORE", [0xA5] = "SIGNATURE_TYPE_VDLL_SYMINFO", [0xA6] = "SIGNATURE_TYPE_IL2_PATTERN", [0xA7] = "SIGNATURE_TYPE_BM_STATIC", [0xA8] = "SIGNATURE_TYPE_BM_INFO", [0xA9] = "SIGNATURE_TYPE_NDAT", [0xAA] = "SIGNATURE_TYPE_FASTPATH_DATA", [0xAB] = "SIGNATURE_TYPE_FASTPATH_SDN", [0xAC] = "SIGNATURE_TYPE_DATABASE_CERT", [0xAD] = "SIGNATURE_TYPE_SOURCE_INFO", [0xAE] = "SIGNATURE_TYPE_HIDDEN_FILE", [0xAF] = "SIGNATURE_TYPE_COMMON_CODE", [0xB0] = "SIGNATURE_TYPE_VREG", [0xB2] = "SIGNATURE_TYPE_VFILEEX", [0xB3] = "SIGNATURE_TYPE_SIGTREE_BM", [0xB4] = "SIGNATURE_TYPE_VBFOP", [0xB5] = "SIGNATURE_TYPE_VDLL_META", [0xB6] = "SIGNATURE_TYPE_TUNNEL_ARM", [0xB7] = "SIGNATURE_TYPE_THREAD_ARM", [0xB8] = "SIGNATURE_TYPE_PCODEVALIDATOR", [0xBA] = "SIGNATURE_TYPE_MSILFOP", [0xBB] = "SIGNATURE_TYPE_KPAT", [0xBC] = "SIGNATURE_TYPE_KPATEX", [0xBD] = "SIGNATURE_TYPE_LUASTANDALONE", [0xBE] = "SIGNATURE_TYPE_DEXHSTR_EXT", [0xBF] = "SIGNATURE_TYPE_JAVAHSTR_EXT", [0xC0] = "SIGNATURE_TYPE_MAGICCODE", [0xC1] = "SIGNATURE_TYPE_CLEANSTORE_RULE", [0xC2] = "SIGNATURE_TYPE_VDLL_CHECKSUM", [0xC3] = "SIGNATURE_TYPE_THREAT_UPDATE_STATUS", [0xC4] = "SIGNATURE_TYPE_VDLL_MSIL", [0xC5] = "SIGNATURE_TYPE_ARHSTR_EXT", [0xC6] = "SIGNATURE_TYPE_MSILFOPEX", [0xC7] = "SIGNATURE_TYPE_VBFOPEX", [0xC8] = "SIGNATURE_TYPE_FOP64", [0xC9] = "SIGNATURE_TYPE_FOPEX64", [0xCA] = "SIGNATURE_TYPE_JSINIT", [0xCB] = "SIGNATURE_TYPE_PESTATICEX", [0xCC] = "SIGNATURE_TYPE_KCRCEX", [0xCD] = "SIGNATURE_TYPE_FTRIE_POS", [0xCE] = "SIGNATURE_TYPE_NID64", [0xCF] = "SIGNATURE_TYPE_MACRO_PCODE64", [0xD0] = "SIGNATURE_TYPE_BRUTE", [0xD1] = "SIGNATURE_TYPE_SWFHSTR_EXT", [0xD2] = "SIGNATURE_TYPE_REWSIGS", [0xD3] = "SIGNATURE_TYPE_AUTOITHSTR_EXT", [0xD4] = "SIGNATURE_TYPE_INNOHSTR_EXT", [0xD5] = "SIGNATURE_TYPE_CERT_STORE_ENTRY", [0xD6] = "SIGNATURE_TYPE_EXPLICITRESOURCE", [0xD7] = "SIGNATURE_TYPE_CMDHSTR_EXT", [0xD8] = "SIGNATURE_TYPE_FASTPATH_TDN", [0xD9] = "SIGNATURE_TYPE_EXPLICITRESOURCEHASH", [0xDA] = "SIGNATURE_TYPE_FASTPATH_SDN_EX", [0xDB] = "SIGNATURE_TYPE_BLOOM_FILTER", [0xDC] = "SIGNATURE_TYPE_RESEARCH_TAG", [0xDE] = "SIGNATURE_TYPE_ENVELOPE", [0xDF] = "SIGNATURE_TYPE_REMOVAL_POLICY64", [0xE0] = "SIGNATURE_TYPE_REMOVAL_POLICY64_BY_NAME", [0xE1] = "SIGNATURE_TYPE_VDLL_META_X64", [0xE2] = "SIGNATURE_TYPE_VDLL_META_ARM", [0xE3] = "SIGNATURE_TYPE_VDLL_META_MSIL", [0xE4] = "SIGNATURE_TYPE_MDBHSTR_EXT", [0xE5] = "SIGNATURE_TYPE_SNIDEX", [0xE6] = "SIGNATURE_TYPE_SNIDEX2", [0xE7] = "SIGNATURE_TYPE_AAGGREGATOREX", [0xE8] = "SIGNATURE_TYPE_PUA_APPMAP", [0xE9] = "SIGNATURE_TYPE_PROPERTY_BAG", [0xEA] = "SIGNATURE_TYPE_DMGHSTR_EXT", [0xEB] = "SIGNATURE_TYPE_DATABASE_CATALOG", [0xEC] = "SIGNATURE_TYPE_DATABASE_CERT2", [0xED] = "SIGNATURE_TYPE_BM_ENV_VAR_MAP", [0x64] = "SIGNATURE_TYPE_HOSTSENTRY", [0x6C] = "SIGNATURE_TYPE_REVOKED_CERTIFICATE", [0x71] = "SIGNATURE_TYPE_ASEP_FILEPATH", [0xD0] ="SIGNATURE_TYPE_BRUTE", [0xBA] ="SIGNATURE_TYPE_MSILFOP", [0xB4] ="SIGNATURE_TYPE_VBFOP", [0xC8] ="SIGNATURE_TYPE_FOP64", [0x8E] ="SIGNATURE_TYPE_DOSHSTR_EXT", [0xC9] ="SIGNATURE_TYPE_FOPEX64", }; public static string GetSignatureType(byte type) { string result; if (SignatureTypeMap.TryGetValue(type, out result)) return result; Console.WriteLine($"[!] Unknown signature type byte: 0x{type:X2}"); return "SIGNATURE_TYPE_UNKNOWN"; } } }