Correct buffer data retrieval logic in etherhiding C2

[kevross33]

Refactor buffer data retrieval to include 'PostData'.

7c98950ce2ec028b5d653e699ca4cb12b09aa84a732be3a8ae9321378cfa5c67

[gemini-code-assist]

Code Review

This pull request modifies the payload extraction logic in the network_c2_etherhiding signature by removing the lpBuffer and lpOptional arguments and adding Optional. However, removing lpBuffer and lpOptional will cause the signature to miss payloads from key APIs such as InternetWriteFile and HttpSendRequestA, leading to false negatives. It is recommended to retain these arguments alongside the newly added ones to ensure comprehensive coverage.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

Removing lpBuffer and lpOptional will cause the signature to miss payloads transmitted via several key APIs listed in filter_apinames:\n\n* InternetWriteFile and WinHttpWriteData pass their payload buffer in the lpBuffer argument.\n* HttpSendRequestA/HttpSendRequestW and WinHttpSendRequest pass their POST/optional data in the lpOptional argument.\n\nBy removing these arguments, the signature will fail to retrieve the buffer data for these APIs, leading to false negatives. We should retain both lpBuffer and lpOptional alongside the newly added Optional and PostData to ensure comprehensive coverage across different API hooks and monitor versions.

        buffer_data = (\n            self.get_argument(call, "buffer")\n            or self.get_argument(call, "Buffer")\n            or self.get_argument(call, "lpBuffer")\n            or self.get_argument(call, "lpOptional")\n            or self.get_argument(call, "Optional")\n            or self.get_argument(call, "PostData")\n        )