andreacristaldi-DefenderRuleParser/Parsers/PuaAppMapParser.cs

// DefenderRuleParser
// Author: Andrea Cristaldi 2025 - https://github.com/andreacristaldi/DefenderRuleParser
// This project is licensed under the Apache 2.0 License.
/*
 * Summary: PUA AppMap parser — maps app identifiers to behaviors/strings.
 * Origin: dump-driven; key/value segments recognized from raw layout.
 * Role: Produces lightweight application fingerprints.
 */
using System;
using System.Collections.Generic;
using System.IO;
using System.Text;
using DefenderRuleParser2.Models;

namespace DefenderRuleParser2.Parsers
{
    public class PuaAppMapParser : ISignatureParser
    {
        public void Parse(BinaryReader reader, int size, uint threatId)
        {
            long offset = reader.BaseStream.Position;
            var strings = new List<string>();

            try
            {
                byte[] data = reader.ReadBytes(size);

                
                var sb = new StringBuilder();
                foreach (byte b in data)
                {
                    if (b >= 32 && b <= 126) 
                        sb.Append((char)b);
                    else
                    {
                        if (sb.Length >= 4)
                        {
                            strings.Add(sb.ToString());
                        }
                        sb.Clear();
                    }
                }
                if (sb.Length >= 4)
                    strings.Add(sb.ToString());

                Logger.Info($"[PUA_APPMAP] Threat ID: {threatId}, Size: {size} bytes");
                foreach (var s in strings)
                    Logger.Info($"  > Text: {s}");

                if (ThreatDatabase.TryGetThreat(threatId, out var threat))
                {
                    threat.Signatures.Add(new SignatureEntry
                    {
                        Type = "SIGNATURE_TYPE_PUA_APPMAP",
                        Offset = offset,
                        Pattern = strings,
                        Parsed = true,
                        ConditionType = "CONTAINS_ANY",
                        ConditionValue = 1
                    });
                }
            }
            catch (Exception ex)
            {
                Logger.Error($"[!] PUA_APPMAP Error parsing at offset 0x{offset:X}: {ex.Message}");
            }
            finally
            {
                reader.BaseStream.Seek(offset + size, SeekOrigin.Begin);
            }
        }
    }
}