Function TestRunSimpleAndSequenceRules

pkg/rules/engine_test.go:324–423

(t *testing.T)

}

func TestRunSimpleAndSequenceRules(t *testing.T) {
	log.SetLevel(log.DebugLevel)

	expectedMatches := make(map[string][]uint64)
	c := newConfig("_fixtures/simple_and_sequence_rules/*.yml")
	c.Filters.MatchAll = true
	e := NewEngine(new(ps.SnapshotterMock), c)
	e.RegisterMatchFunc(func(f *config.FilterConfig, evts ...*event.Event) {
		ids := make([]uint64, 0)
		for _, evt := range evts {
			ids = append(ids, evt.Seq)
		}
		expectedMatches[f.Name] = ids
	})

	compileRules(t, e)

	evts := []*event.Event{
		{
			Seq:       1,
			Type:      event.CreateProcess,
			Timestamp: time.Now(),
			Category:  event.Process,
			Name:      "CreateProcess",
			Tid:       2484,
			PID:       2243,
			PS: &types.PS{
				Name: "powershell.exe",
				Exe:  "C:\\Windows\\system32\\powershell.exe",
			},
			Params: event.Params{
				params.ProcessID:   {Name: params.ProcessID, Type: params.PID, Value: uint32(2243)},
				params.ProcessName: {Name: params.ProcessName, Type: params.UnicodeString, Value: "powershell.exe"},
			},
			Metadata: map[event.MetadataKey]any{"foo": "bar", "fooz": "barzz"},
		},
		{
			Seq:       2,
			Type:      event.CreateFile,
			Timestamp: time.Now().Add(time.Millisecond * 544),
			Name:      "CreateFile",
			Tid:       2484,
			PID:       2243,
			Category:  event.File,
			PS: &types.PS{
				Name: "cmd.exe",
				Exe:  "C:\\Windows\\system32\\cmd.exe",
			},
			Params: event.Params{
				params.FilePath:      {Name: params.FilePath, Type: params.UnicodeString, Value: "C:\\Temp\\dropper.exe"},
				params.FileOperation: {Name: params.FileOperation, Type: params.Enum, Value: uint32(2)},
			},
			Metadata: map[event.MetadataKey]any{"foo": "bar", "fooz": "barzz"},
		},
		{
			Seq:       10,
			Type:      event.CreateProcess,
			Timestamp: time.Now().Add(time.Second * 2),