andreacristaldi-DefenderRuleParser/Parsers/AsepFilepathParser.cs

// DefenderRuleParser
// Author: Andrea Cristaldi 2025 - https://github.com/andreacristaldi/DefenderRuleParser
// This project is licensed under the Apache 2.0 License.
/*
 * Summary: Extracts suspicious ASEP file paths (auto-start extensibility points) from hex chunks.
 * Origin: dump-driven; field boundaries and encodings inferred from raw dumps.
 * Role: Decodes path-like UTF-16/ASCII and normalizes into human-readable entries.
 */
using DefenderRuleParser2;
using DefenderRuleParser2.Models;
using System;
using System.Collections.Generic;
using System.IO;
using System.Text;

namespace DefenderRuleParser2.Parsers
{
    public class AsepFilepathParser : ISignatureParser
    {
        public void Parse(BinaryReader reader, int size, uint threatId)
        {
            long offset = reader.BaseStream.Position;

            try
            {
                byte[] buffer = reader.ReadBytes(size);

                using (MemoryStream ms = new MemoryStream(buffer))
                using (BinaryReader br = new BinaryReader(ms))
                {
                    if (size < 3)
                    {
                        Logger.Info("[ASEP_FILEPATH] ❗ Signature too short.");
                        return;
                    }

                    ushort threshold = br.ReadUInt16();
                    byte[] pathBytes = br.ReadBytes(size - 2);
                    string filePath = Encoding.UTF8.GetString(pathBytes).TrimEnd('\0');

                    Logger.Info(string.Format("[ASEP_FILEPATH] Threat ID: {0}, Threshold: {1}", threatId, threshold));
                    Logger.Info("  > Path:   " + filePath);

                    if (!string.IsNullOrWhiteSpace(filePath) && ThreatDatabase.TryGetThreat(threatId, out var threat))
                    {
                        threat.Signatures.Add(new SignatureEntry
                        {
                            Type = "SIGNATURE_TYPE_ASEP_FILEPATH",
                            Offset = offset,
                            Pattern = new List<string> { filePath },
                            Parsed = true,
                            ConditionType = (threshold > 1) ? "MIN_MATCHES" : "PRESENT",
                            ConditionValue = threshold
                        });
                    }
                }
            }
            catch (Exception ex)
            {
                Logger.Error(string.Format("[!] ASEP_FILEPATH Error parsing at offset 0x{0:X}: {1}", offset, ex.Message));
            }
            finally
            {
                reader.BaseStream.Seek(offset + size, SeekOrigin.Begin);
            }
        }
    }
}