From 72f0bd1bbafe69cc6695985a13aded63d7edc576 Mon Sep 17 00:00:00 2001
From: SolitudePy <47316655+SolitudePy@users.noreply.github.com>
Date: Fri, 6 Jun 2025 17:22:39 +0300
Subject: [PATCH] UNICODE_STRING length checks to further detect spoofing

---
 .../plugins/windows/pebmasquerade.py          | 46 +++++++++++++++++++
 1 file changed, 46 insertions(+)

diff --git a/volatility3/framework/plugins/windows/pebmasquerade.py b/volatility3/framework/plugins/windows/pebmasquerade.py
index dc5293271..c1bfca67f 100644
--- a/volatility3/framework/plugins/windows/pebmasquerade.py
+++ b/volatility3/framework/plugins/windows/pebmasquerade.py
@@ -219,6 +219,12 @@ class PebMasquerade(interfaces.plugins.PluginInterface):
             filter_func=pid_filter,
         ):
             proc_id = proc.UniqueProcessId
+            try:
+                peb = proc.get_peb()
+            except (exceptions.InvalidAddressException, AttributeError):
+                vollog.debug(
+                    "Unable to access PEB for PID %d, skipping process", proc_id
+                )
             notes = []
 
             (
@@ -300,6 +306,46 @@ class PebMasquerade(interfaces.plugins.PluginInterface):
                         f"SeAuditProcessCreationInfo comparison error: {str(e)[:30]}"
                     )
 
+            if isinstance(peb_imagefilepath, str) and peb:
+                try:
+
+                    # Length values are of type USHORT
+                    peb_imagefilepath_length = (
+                        peb.ProcessParameters.ImagePathName.Length // 2
+                    )
+                    peb_imagefilepath_maxlength = (
+                        peb.ProcessParameters.ImagePathName.MaximumLength // 2 - 1
+                    )
+
+                    if (peb_imagefilepath_length != len(peb_imagefilepath)) or (
+                        peb_imagefilepath_maxlength != len(peb_imagefilepath)
+                    ):
+                        notes.append(
+                            f"'PEB.ImageFilePath Length Mismatch: Length={peb_imagefilepath_length}, MaximumLength={peb_imagefilepath_maxlength}, Actual={len(peb_imagefilepath)}'"
+                        )
+                except Exception as e:
+                    notes.append(
+                        f"PEB.ImageFilePath Length comparison error: {str(e)[:30]}"
+                    )
+
+            if isinstance(peb_cmdline, str) and peb:
+                try:
+                    # Length values are of type USHORT
+                    peb_cmdline_length = peb.ProcessParameters.CommandLine.Length // 2
+                    peb_cmdline_maxlength = (
+                        peb.ProcessParameters.CommandLine.MaximumLength // 2 - 1
+                    )
+
+                    if (peb_cmdline_length != len(peb_cmdline)) or (
+                        peb_cmdline_maxlength != len(peb_cmdline)
+                    ):
+                        notes.append(
+                            f"'PEB.CommandLine Length Mismatch: Commandline={peb_cmdline}, Length={peb_cmdline_length}, MaximumLength={peb_cmdline_maxlength}, Actual={len(peb_cmdline)}'"
+                        )
+                except Exception as e:
+                    notes.append(
+                        f"PEB.CommandLine Length comparison error: {str(e)[:30]}"
+                    )
             yield (
                 0,
                 (