(t *testing.T)
| 25 | ) |
| 26 | |
| 27 | func TestParseError(t *testing.T) { |
| 28 | expr := `evt.name in ('RegCreateKey', 'RegDeleteKey', 'RegSetValue', 'RegDeleteValue') |
| 29 | and |
| 30 | registry.key.name icontains |
| 31 | ( |
| 32 | CurrentVersion\\Run', |
| 33 | 'Policies\\Explorer\\Run', |
| 34 | 'Group Policy\\Scripts', |
| 35 | 'Windows\\System\\Scripts', |
| 36 | 'CurrentVersion\\Windows\\Load', |
| 37 | 'CurrentVersion\\Windows\\Run', |
| 38 | 'CurrentVersion\\Winlogon\\Shell', |
| 39 | 'CurrentVersion\\Winlogon\\System', |
| 40 | 'UserInitMprLogonScript' |
| 41 | ) |
| 42 | or |
| 43 | registry.key.name istartswith |
| 44 | ( |
| 45 | 'HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Notify', |
| 46 | 'HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell', |
| 47 | 'HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Userinit', |
| 48 | 'HKEY_LOCAL_MACHINE\\Software\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Drivers32', |
| 49 | 'HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\BootExecute', |
| 50 | 'HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AeDebug' |
| 51 | ) |
| 52 | or |
| 53 | registry.key.name iendswith |
| 54 | ( |
| 55 | 'user shell folders\\startup' |
| 56 | )` |
| 57 | expected := `evt.name in ('RegCreateKey', 'RegDeleteKey', 'RegSetValue', 'RegDeleteValue') |
| 58 | and |
| 59 | registry.key.name icontains |
| 60 | ( |
| 61 | CurrentVersion\\Run', |
| 62 | ╭──────────────^ |
| 63 | | |
| 64 | | 'Policies\\Explorer\\Run', |
| 65 | | 'Group Policy\\Scripts', |
| 66 | | 'Windows\\System\\Scripts', |
| 67 | | 'CurrentVersion\\Windows\\Load', |
| 68 | | 'CurrentVersion\\Windows\\Run', |
| 69 | | 'CurrentVersion\\Winlogon\\Shell', |
| 70 | | 'CurrentVersion\\Winlogon\\System', |
| 71 | | 'UserInitMprLogonScript' |
| 72 | | ) |
| 73 | | or |
| 74 | | registry.key.name istartswith |
| 75 | | ( |
| 76 | | 'HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Notify', |
| 77 | | 'HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell', |
| 78 | | 'HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Userinit', |
| 79 | | 'HKEY_LOCAL_MACHINE\\Software\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Drivers32', |
| 80 | | 'HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\BootExecute', |
| 81 | | 'HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AeDebug' |
| 82 | | ) |
| 83 | | or |
| 84 | | registry.key.name iendswith |
nothing calls this directly
no test coverage detected