Function TestSequenceState

pkg/rules/sequence_test.go:40–186

(t *testing.T)

)

func TestSequenceState(t *testing.T) {
	log.SetLevel(log.DebugLevel)

	c := &config.FilterConfig{Name: "Command shell created and executed by file"}
	f := filter.New(`
	sequence
	maxspan 100ms
  	|evt.name = 'CreateProcess' and ps.name = 'cmd.exe'| by ps.exe
  	|evt.name = 'CreateFile' and file.path icontains 'temp'| by file.path
		|evt.name = 'CreateProcess'| by ps.exe`,
		&config.Config{EventSource: config.EventSourceConfig{}, Filters: &config.Filters{}})

	require.NoError(t, f.Compile())

	ss := newSequenceState(f, c, new(ps.SnapshotterMock))

	assert.Equal(t, 0, ss.currentState())
	assert.True(t, ss.isInitialState())
	assert.Equal(t, "evt.name = CreateProcess AND ps.name = cmd.exe", ss.expr(ss.initialState))

	e1 := &event.Event{
		Type:      event.CreateProcess,
		Name:      "CreateProcess",
		Tid:       2484,
		PID:       859,
		Timestamp: time.Now(),
		PS: &pstypes.PS{
			Name: "cmd.exe",
			Exe:  "C:\\Windows\\system32\\svchost.exe",
		},
		Params: event.Params{
			params.ProcessID:   {Name: params.ProcessID, Type: params.PID, Value: uint32(4143)},
			params.ProcessName: {Name: params.ProcessName, Type: params.AnsiString, Value: "powershell.exe"},
		},
	}

	e2 := &event.Event{
		Type:      event.CreateFile,
		Name:      "CreateFile",
		Tid:       2484,
		PID:       4143,
		Timestamp: time.Now().Add(time.Second * 5),
		PS: &pstypes.PS{
			Name: "cmd.exe",
			Exe:  "C:\\Windows\\system32\\svchost.exe",
		},
		Params: event.Params{
			params.FilePath: {Name: params.FilePath, Type: params.UnicodeString, Value: "C:\\Temp\\dropper"},
		},
	}

	require.True(t, ss.next(0))
	require.False(t, ss.next(1))
	require.NoError(t, ss.matchTransition(0, e1))
	ss.addPartial(0, e1, false)
	require.True(t, ss.next(1))
	assert.True(t, ss.states[0])
	require.False(t, ss.next(2))