admin/andreacristaldi-DefenderRuleParser
1
0
Fork 0
mirror of https://github.com/andreacristaldi/DefenderRuleParser synced 2026-06-16 13:55:00 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
main
andreacristaldi-DefenderRul…/SignatureTypeMapper.cs
T
Andrea Cristaldi 492ffc428b First commit
2025-08-28 17:14:35 +02:00

196 lines
8.6 KiB
C#
Raw Permalink Blame History

// DefenderRuleParser
// Author: Andrea Cristaldi 2025 - https://github.com/andreacristaldi/DefenderRuleParser
// This project is licensed under the Apache 2.0 License.
using System;
using System.Collections.Generic;
namespace DefenderRuleParser2
{
public static class SignatureTypeMapper
{
private static readonly Dictionary<byte, string> SignatureTypeMap = new Dictionary<byte, string>
{
[0x5C] = "SIGNATURE_TYPE_THREAT_BEGIN",
[0x5D] = "SIGNATURE_TYPE_THREAT_END",
//[0x68] = "SIGNATURE_TYPE_FNAME",
//[0x69] = "SIGNATURE_TYPE_CATEGORY",
//[0x6A] = "SIGNATURE_TYPE_NAME",
// Common signature types
[0x61] = "SIGNATURE_TYPE_PEHSTR",
[0x78] = "SIGNATURE_TYPE_PEHSTR_EXT",
[0x62] = "SIGNATURE_TYPE_LOCALHASH",
[0x67] = "SIGNATURE_TYPE_STATIC",
[0x63] = "SIGNATURE_TYPE_REGKEY",
[0x5F] = "SIGNATURE_TYPE_FILEPATH",
[0x5E] = "SIGNATURE_TYPE_FILENAME",
[0x60] = "SIGNATURE_TYPE_FOLDERNAME",
[0x51] = "SIGNATURE_TYPE_PATTMATCH",
[0x77] = "SIGNATURE_TYPE_PATTMATCH_V2",
[0x79] = "SIGNATURE_TYPE_VDLL_X86",
[0x7A] = "SIGNATURE_TYPE_LUASTANDALONE",
// Additional
[0x11] = "SIGNATURE_TYPE_CKOLDREC",
[0x1C] = "SIGNATURE_TYPE_RESERVED",
[0x20] = "SIGNATURE_TYPE_KVIR32",
[0x21] = "SIGNATURE_TYPE_POLYVIR32",
[0x27] = "SIGNATURE_TYPE_NSCRIPT_NORMAL",
[0x28] = "SIGNATURE_TYPE_NSCRIPT_SP",
[0x29] = "SIGNATURE_TYPE_NSCRIPT_BRUTE",
[0x2C] = "SIGNATURE_TYPE_NSCRIPT_CURE",
[0x30] = "SIGNATURE_TYPE_TITANFLT",
[0x32] = "SIGNATURE_TYPE_MACROHSTR_EXT",
[0x3D] = "SIGNATURE_TYPE_PEFILE_CURE",
[0x3E] = "SIGNATURE_TYPE_MAC_CURE",
[0x40] = "SIGNATURE_TYPE_SIGTREE",
[0x41] = "SIGNATURE_TYPE_SIGTREE_EXT",
[0x42] = "SIGNATURE_TYPE_MACRO_PCODE",
[0x43] = "SIGNATURE_TYPE_MACRO_SOURCE",
[0x44] = "SIGNATURE_TYPE_BOOT",
[0x49] = "SIGNATURE_TYPE_CLEANSCRIPT",
[0x50] = "SIGNATURE_TYPE_CKSIMPLEREC",
[0x53] = "SIGNATURE_TYPE_RPFROUTINE",
[0x55] = "SIGNATURE_TYPE_NID",
[0x56] = "SIGNATURE_TYPE_GENSFX",
[0x57] = "SIGNATURE_TYPE_UNPLIB",
[0x58] = "SIGNATURE_TYPE_DEFAULTS",
[0x5B] = "SIGNATURE_TYPE_DBVAR",
[0x5C] = "SIGNATURE_TYPE_THREAT_BEGIN",
[0x6A] = "SIGNATURE_TYPE_REMOVAL_POLICY",
[0x7A] = "SIGNATURE_TYPE_VERSIONCHECK",
[0x7B] = "SIGNATURE_TYPE_SAMPLE_REQUEST",
[0x7C] = "SIGNATURE_TYPE_VDLL_X64",
[0x7E] = "SIGNATURE_TYPE_SNID",
[0x7F] = "SIGNATURE_TYPE_FOP",
[0x80] = "SIGNATURE_TYPE_KCRCE",
[0x83] = "SIGNATURE_TYPE_VFILE",
[0x84] = "SIGNATURE_TYPE_SIGFLAGS",
[0x85] = "SIGNATURE_TYPE_PEHSTR_EXT2",
[0x86] = "SIGNATURE_TYPE_PEMAIN_LOCATOR",
[0x87] = "SIGNATURE_TYPE_PESTATIC",
[0x88] = "SIGNATURE_TYPE_UFSP_DISABLE",
[0x89] = "SIGNATURE_TYPE_FOPEX",
[0x8A] = "SIGNATURE_TYPE_PEPCODE",
[0x8B] = "SIGNATURE_TYPE_IL_PATTERN",
[0x8C] = "SIGNATURE_TYPE_ELFHSTR_EXT",
[0x8D] = "SIGNATURE_TYPE_MACHOHSTR_EXT",
[0x8E] = "SIGNATURE_TYPE_DOSHSTR_EXT",
[0x8F] = "SIGNATURE_TYPE_MACROHSTR_EXT",
[0x90] = "SIGNATURE_TYPE_TARGET_SCRIPT_PCODE",
[0x91] = "SIGNATURE_TYPE_VDLL_IA64",
[0x95] = "SIGNATURE_TYPE_PEBMPAT",
[0x96] = "SIGNATURE_TYPE_AAGGREGATOR",
[0x97] = "SIGNATURE_TYPE_SAMPLE_REQUEST_BY_NAME",
[0x98] = "SIGNATURE_TYPE_REMOVAL_POLICY_BY_NAME",
[0x99] = "SIGNATURE_TYPE_TUNNEL_X86",
[0x9A] = "SIGNATURE_TYPE_TUNNEL_X64",
[0x9B] = "SIGNATURE_TYPE_TUNNEL_IA64",
[0x9C] = "SIGNATURE_TYPE_VDLL_ARM",
[0x9E] = "SIGNATURE_TYPE_THREAD_X64",
[0x9F] = "SIGNATURE_TYPE_THREAD_IA64",
[0xA0] = "SIGNATURE_TYPE_FRIENDLYFILE_SHA256",
[0xA1] = "SIGNATURE_TYPE_FRIENDLYFILE_SHA512",
[0xA2] = "SIGNATURE_TYPE_SHARED_THREAT",
[0xA3] = "SIGNATURE_TYPE_VDM_METADATA",
[0xA4] = "SIGNATURE_TYPE_VSTORE",
[0xA5] = "SIGNATURE_TYPE_VDLL_SYMINFO",
[0xA6] = "SIGNATURE_TYPE_IL2_PATTERN",
[0xA7] = "SIGNATURE_TYPE_BM_STATIC",
[0xA8] = "SIGNATURE_TYPE_BM_INFO",
[0xA9] = "SIGNATURE_TYPE_NDAT",
[0xAA] = "SIGNATURE_TYPE_FASTPATH_DATA",
[0xAB] = "SIGNATURE_TYPE_FASTPATH_SDN",
[0xAC] = "SIGNATURE_TYPE_DATABASE_CERT",
[0xAD] = "SIGNATURE_TYPE_SOURCE_INFO",
[0xAE] = "SIGNATURE_TYPE_HIDDEN_FILE",
[0xAF] = "SIGNATURE_TYPE_COMMON_CODE",
[0xB0] = "SIGNATURE_TYPE_VREG",
[0xB2] = "SIGNATURE_TYPE_VFILEEX",
[0xB3] = "SIGNATURE_TYPE_SIGTREE_BM",
[0xB4] = "SIGNATURE_TYPE_VBFOP",
[0xB5] = "SIGNATURE_TYPE_VDLL_META",
[0xB6] = "SIGNATURE_TYPE_TUNNEL_ARM",
[0xB7] = "SIGNATURE_TYPE_THREAD_ARM",
[0xB8] = "SIGNATURE_TYPE_PCODEVALIDATOR",
[0xBA] = "SIGNATURE_TYPE_MSILFOP",
[0xBB] = "SIGNATURE_TYPE_KPAT",
[0xBC] = "SIGNATURE_TYPE_KPATEX",
[0xBD] = "SIGNATURE_TYPE_LUASTANDALONE",
[0xBE] = "SIGNATURE_TYPE_DEXHSTR_EXT",
[0xBF] = "SIGNATURE_TYPE_JAVAHSTR_EXT",
[0xC0] = "SIGNATURE_TYPE_MAGICCODE",
[0xC1] = "SIGNATURE_TYPE_CLEANSTORE_RULE",
[0xC2] = "SIGNATURE_TYPE_VDLL_CHECKSUM",
[0xC3] = "SIGNATURE_TYPE_THREAT_UPDATE_STATUS",
[0xC4] = "SIGNATURE_TYPE_VDLL_MSIL",
[0xC5] = "SIGNATURE_TYPE_ARHSTR_EXT",
[0xC6] = "SIGNATURE_TYPE_MSILFOPEX",
[0xC7] = "SIGNATURE_TYPE_VBFOPEX",
[0xC8] = "SIGNATURE_TYPE_FOP64",
[0xC9] = "SIGNATURE_TYPE_FOPEX64",
[0xCA] = "SIGNATURE_TYPE_JSINIT",
[0xCB] = "SIGNATURE_TYPE_PESTATICEX",
[0xCC] = "SIGNATURE_TYPE_KCRCEX",
[0xCD] = "SIGNATURE_TYPE_FTRIE_POS",
[0xCE] = "SIGNATURE_TYPE_NID64",
[0xCF] = "SIGNATURE_TYPE_MACRO_PCODE64",
[0xD0] = "SIGNATURE_TYPE_BRUTE",
[0xD1] = "SIGNATURE_TYPE_SWFHSTR_EXT",
[0xD2] = "SIGNATURE_TYPE_REWSIGS",
[0xD3] = "SIGNATURE_TYPE_AUTOITHSTR_EXT",
[0xD4] = "SIGNATURE_TYPE_INNOHSTR_EXT",
[0xD5] = "SIGNATURE_TYPE_CERT_STORE_ENTRY",
[0xD6] = "SIGNATURE_TYPE_EXPLICITRESOURCE",
[0xD7] = "SIGNATURE_TYPE_CMDHSTR_EXT",
[0xD8] = "SIGNATURE_TYPE_FASTPATH_TDN",
[0xD9] = "SIGNATURE_TYPE_EXPLICITRESOURCEHASH",
[0xDA] = "SIGNATURE_TYPE_FASTPATH_SDN_EX",
[0xDB] = "SIGNATURE_TYPE_BLOOM_FILTER",
[0xDC] = "SIGNATURE_TYPE_RESEARCH_TAG",
[0xDE] = "SIGNATURE_TYPE_ENVELOPE",
[0xDF] = "SIGNATURE_TYPE_REMOVAL_POLICY64",
[0xE0] = "SIGNATURE_TYPE_REMOVAL_POLICY64_BY_NAME",
[0xE1] = "SIGNATURE_TYPE_VDLL_META_X64",
[0xE2] = "SIGNATURE_TYPE_VDLL_META_ARM",
[0xE3] = "SIGNATURE_TYPE_VDLL_META_MSIL",
[0xE4] = "SIGNATURE_TYPE_MDBHSTR_EXT",
[0xE5] = "SIGNATURE_TYPE_SNIDEX",
[0xE6] = "SIGNATURE_TYPE_SNIDEX2",
[0xE7] = "SIGNATURE_TYPE_AAGGREGATOREX",
[0xE8] = "SIGNATURE_TYPE_PUA_APPMAP",
[0xE9] = "SIGNATURE_TYPE_PROPERTY_BAG",
[0xEA] = "SIGNATURE_TYPE_DMGHSTR_EXT",
[0xEB] = "SIGNATURE_TYPE_DATABASE_CATALOG",
[0xEC] = "SIGNATURE_TYPE_DATABASE_CERT2",
[0xED] = "SIGNATURE_TYPE_BM_ENV_VAR_MAP",
[0x64] = "SIGNATURE_TYPE_HOSTSENTRY",
[0x6C] = "SIGNATURE_TYPE_REVOKED_CERTIFICATE",
[0x71] = "SIGNATURE_TYPE_ASEP_FILEPATH",
[0xD0] ="SIGNATURE_TYPE_BRUTE",
[0xBA] ="SIGNATURE_TYPE_MSILFOP",
[0xB4] ="SIGNATURE_TYPE_VBFOP",
[0xC8] ="SIGNATURE_TYPE_FOP64",
[0x8E] ="SIGNATURE_TYPE_DOSHSTR_EXT",
[0xC9] ="SIGNATURE_TYPE_FOPEX64",
};
public static string GetSignatureType(byte type)
{
string result;
if (SignatureTypeMap.TryGetValue(type, out result))
return result;
Console.WriteLine($"[!] Unknown signature type byte: 0x{type:X2}");
return "SIGNATURE_TYPE_UNKNOWN";
}
}
}
Reference in New Issue View Git Blame Copy Permalink