andreacristaldi-DefenderRuleParser/SignatureDispatcher.cs

// DefenderRuleParser
// Author: Andrea Cristaldi 2025 - https://github.com/andreacristaldi/DefenderRuleParser
// This project is licensed under the Apache 2.0 License.
/*
 * Summary: Central router that maps signature types to their dump-driven parsers.
 * Origin: dump-driven; type codes and sizes observed in hex headers.
 * Role: Chooses the correct parser at runtime and handles basic bounds/logging.
 */
using DefenderRuleParser2.Parsers;
using DefenderRuleParser2.Models;
using System;
using System.Collections.Generic;
using System.IO;

namespace DefenderRuleParser2
{
    public static class SignatureDispatcher
    {
        private static readonly Dictionary<string, ISignatureParser> Parsers = new Dictionary<string, ISignatureParser>
        {
            // Heuristic String-based detection (PE/ELF/etc.)
            { "SIGNATURE_TYPE_POLYVIR32", new Polyvir32Parser() },
            { "SIGNATURE_TYPE_PEHSTR",new PehstrParser() }, 

            // Registry keys
            { "SIGNATURE_TYPE_REGKEY", new RegKeyParser() },

            // File system
            { "SIGNATURE_TYPE_FILEPATH", new FilePathParser() },
            { "SIGNATURE_TYPE_FOLDERNAME", new FolderNameParser() },
            { "SIGNATURE_TYPE_ASEP_FILEPATH", new AsepFilepathParser() },
            { "SIGNATURE_TYPE_ASEP_FOLDERNAME", new AsepFoldernameParser() },

            // Static hashes / fingerprints
            { "SIGNATURE_TYPE_KCRCE", new KcrceParser() },
            { "SIGNATURE_TYPE_KCRCEEX", new KcrceexParser() },
            { "SIGNATURE_TYPE_STATIC", new StaticHashParser() },
            { "SIGNATURE_TYPE_PESTATIC", new PestaticParser() },
            { "SIGNATURE_TYPE_PESTATICEX", new PestaticExParser() },
            
            
            { "SIGNATURE_TYPE_FRIENDLYFILE_SHA256", new FriendlyFileSha256Parser() },
            
           
                       
            // Lua embedded
            { "SIGNATURE_TYPE_LUASTANDALONE", new LuaParser() },

            // Signature trees
            { "SIGNATURE_TYPE_SIGTREE", new SigTreeParser() },// 
            { "SIGNATURE_TYPE_SIGTREE_EXT", new SigTreeExtParser() },
            { "SIGNATURE_TYPE_SIGTREE_BM", new SigTreeBmParser() },

            { "SIGNATURE_TYPE_DEFAULTS", new DefaultsParser() },

            // NScript
            { "SIGNATURE_TYPE_NSCRIPT_CURE", new NscriptCureParser() },
            
            
            // Execution structures
            { "SIGNATURE_TYPE_PEPCODE", new PepCodeParser() },

            // App reputation / telemetry
            { "SIGNATURE_TYPE_PUA_APPMAP", new PuaAppMapParser() },
            { "SIGNATURE_TYPE_NDAT", new NdatParser() }
            
        };

        static SignatureDispatcher()
        {
            // HSTR-compatible types → GenericHstrExtParser
            var hstrTypes = new[]
            {
                
                "SIGNATURE_TYPE_PEHSTR_EXT",
                "SIGNATURE_TYPE_PEHSTR_EXT2",
                "SIGNATURE_TYPE_JAVAHSTR_EXT",
                "SIGNATURE_TYPE_DEXHSTR_EXT",
                "SIGNATURE_TYPE_ELFHSTR_EXT",
                "SIGNATURE_TYPE_MACHOHSTR_EXT",
                "SIGNATURE_TYPE_SWFHSTR_EXT",
                "SIGNATURE_TYPE_CMDHSTR_EXT",
                "SIGNATURE_TYPE_MDBHSTR_EXT",
                "SIGNATURE_TYPE_AUTOITHSTR_EXT",
                "SIGNATURE_TYPE_DMGHSTR_EXT",
                "SIGNATURE_TYPE_ARHSTR_EXT",
                "SIGNATURE_TYPE_INNOHSTR_EXT",
                "SIGNATURE_TYPE_PEBMPAT",
                "SIGNATURE_TYPE_KPAT",
                "SIGNATURE_TYPE_KPATEX",
                "SIGNATURE_TYPE_FOPEX",
                "SIGNATURE_TYPE_MACROHSTR_EXT",
                "SIGNATURE_TYPE_AAGGREGATOR",
                "SIGNATURE_TYPE_DOSHSTR_EXT",

            };

            foreach (var type in hstrTypes)
            {
                Parsers[type] = new GenericWeightedPatternParser(type);
            }

            var binaryTypes = new[]
            {
                "SIGNATURE_TYPE_NID",
                "SIGNATURE_TYPE_NID64",
                "SIGNATURE_TYPE_IL_PATTERN",
                "SIGNATURE_TYPE_FOP",
                "SIGNATURE_TYPE_VFILE",
                "SIGNATURE_TYPE_FASTPATH_SDN",
                "SIGNATURE_TYPE_FASTPATH_TDN",
                "SIGNATURE_TYPE_EXPLICITRESOURCE",
                "SIGNATURE_TYPE_DATABASE_CERT",
                "SIGNATURE_TYPE_AAGGREGATOREX",
                "SIGNATURE_TYPE_SNID",
                "SIGNATURE_TYPE_NSCRIPT_SP",
                "SIGNATURE_TYPE_NSCRIPT_NORMAL",
                "SIGNATURE_TYPE_CKSIMPLEREC",
                "SIGNATURE_TYPE_CKOLDREC",
                "SIGNATURE_TYPE_BOOT",
                "SIGNATURE_TYPE_MACRO_PCODE",
                "SIGNATURE_TYPE_MACRO_PCODE64",
                "SIGNATURE_TYPE_TARGET_SCRIPT_PCODE",
                "SIGNATURE_TYPE_UFSP_DISABLE",
                "SIGNATURE_TYPE_THREAD_X86",
                "SIGNATURE_TYPE_VERSIONCHECK",
                "SIGNATURE_TYPE_MSILFOP",
                "SIGNATURE_TYPE_VBFOP",
                "SIGNATURE_TYPE_FOP64",
                "SIGNATURE_TYPE_FOPEX64",
                "SIGNATURE_TYPE_PATTMATCH",
                "SIGNATURE_TYPE_PATTMATCH_V2",

            };

            foreach (var type in binaryTypes)
            {
                Parsers[type] = new GenericBinarySignatureParser(type);
            }

            var textTypes = new[]
            {
                "SIGNATURE_TYPE_NSCRIPT_BRUTE",
                "SIGNATURE_TYPE_CLEANSCRIPT",
                "SIGNATURE_TYPE_RESEARCH_TAG",
                "SIGNATURE_TYPE_SOURCE_INFO",
                "SIGNATURE_TYPE_REMOVAL_POLICY",
                "SIGNATURE_TYPE_REMOVAL_POLICY_BY_NAME",
                "SIGNATURE_TYPE_TARGET_SCRIPT",
                "SIGNATURE_TYPE_MACRO_SOURCE",
                "SIGNATURE_TYPE_HOSTSENTRY",
                "SIGNATURE_TYPE_RESEARCH_TAG_EXT",
                "SIGNATURE_TYPE_SOURCE_TAG",
                "SIGNATURE_TYPE_NSCRIPT_SOURCE",
                "SIGNATURE_TYPE_POLICY_NOTE",
                "SIGNATURE_TYPE_SIGCOMMENT",
                "SIGNATURE_TYPE_HOSTSENTRY",
                "SIGNATURE_TYPE_REVOKED_CERTIFICATE",
                "SIGNATURE_TYPE_BRUTE",
                "SIGNATURE_TYPE_BM_INFO"

            };

            foreach (var type in textTypes)
            {
                Parsers[type] = new GenericTextDumpParser(type);
            }


            Parsers["SIGNATURE_TYPE_LOCALHASH"] = new GenericFixedHashListParser(FixedHashOptions.ForLocalHash());
            Parsers["SIGNATURE_TYPE_KVIR32"] = new GenericFixedHashListParser(FixedHashOptions.ForKvir32());

                    }

        public static void Dispatch(string sigType, BinaryReader reader, int size, uint threatId)
        {
            long offset = reader.BaseStream.Position;

            if (Parsers.TryGetValue(sigType, out var parser))
            {
                parser.Parse(reader, size, threatId);
            }
            else
            {
                Console.WriteLine("[!] No parser implemented for signature type: " + sigType);
                
                reader.BaseStream.Seek(size, SeekOrigin.Current); // Skip unknown
            }

            if (ThreatDatabase.TryGetThreat(threatId, out var threat))
            {
                if (!threat.SignatureStats.ContainsKey(sigType))
                    threat.SignatureStats[sigType] = 0;

                threat.SignatureStats[sigType]++;
            }
        }
    }
}