Function TestEvasionScanner

internal/etw/source_test.go:1289–1414

(t *testing.T)

}

func TestEvasionScanner(t *testing.T) {
	var tests = []*struct {
		name      string
		gen       func() error
		want      func(e *event.Event) bool
		completed bool
	}{
		{
			"direct syscall",
			func() error {
				cmd := exec.Command("_fixtures/direct-syscall/direct-syscall.exe")
				return cmd.Run()
			},
			func(e *event.Event) bool {
				if strings.Contains(strings.ToLower(e.Callstack.String()), strings.ToLower("direct-syscall.exe")) && e.Type == event.SetThreadContext {
					log.Info(e, e.Callstack)
					return containsEvasion(e, "direct_syscall")
				}
				return false
			},
			false,
		},
		{
			"indirect syscall",
			func() error {
				cmd := exec.Command("_fixtures/indirect-syscall/indirect-syscall.exe")
				return cmd.Run()
			},
			func(e *event.Event) bool {
				if strings.Contains(strings.ToLower(e.Callstack.String()), strings.ToLower("indirect-syscall.exe")) && e.Type == event.SetThreadContext {
					log.Info(e, e.Callstack)
					return containsEvasion(e, "indirect_syscall")
				}
				return false
			},
			false,
		},
	}

	evsConfig := config.EventSourceConfig{
		EnableThreadEvents:   true,
		EnableModuleEvents:   true,
		EnableFileIOEvents:   false,
		EnableVAMapEvents:    true,
		EnableNetEvents:      true,
		EnableRegistryEvents: false,
		EnableMemEvents:      false,
		EnableHandleEvents:   false,
		EnableDNSEvents:      false,
		EnableAuditAPIEvents: true,
		StackEnrichment:      true,
	}
	evsConfig.Init()

	hsnap := new(handle.SnapshotterMock)
	hsnap.On("FindByObject", mock.Anything).Return(htypes.Handle{}, false)
	hsnap.On("FindHandles", mock.Anything).Return([]htypes.Handle{}, nil)
	hsnap.On("Write", mock.Anything).Return(nil)