Function TestSimpleSequenceMultiplePartials

pkg/rules/sequence_test.go:273–380

(t *testing.T)

}

func TestSimpleSequenceMultiplePartials(t *testing.T) {
	log.SetLevel(log.DebugLevel)

	c := &config.FilterConfig{Name: "Command shell created a temp file"}
	f := filter.New(`
	sequence
  maxspan 200ms
  by ps.pid
    |evt.name = 'CreateProcess' and ps.name = 'cmd.exe'|
    |evt.name = 'CreateFile' and file.path icontains 'temp'|
	`, &config.Config{EventSource: config.EventSourceConfig{EnableFileIOEvents: true}, Filters: &config.Filters{}})
	require.NoError(t, f.Compile())

	ss := newSequenceState(f, c, new(ps.SnapshotterMock))

	// create random matches which don't satisfy the sequence link
	for i, pid := range []uint32{2343, 1024, 11122, 3450, 12319} {
		e1 := &event.Event{
			Type:      event.CreateProcess,
			Timestamp: time.Now().Add(time.Duration(i) * time.Millisecond),
			Name:      "CreateProcess",
			Tid:       2484,
			PID:       pid % 2,
			PS: &pstypes.PS{
				Name: "cmd.exe",
				Exe:  "C:\\Windows\\system32\\cmd.exe",
			},
			Params: event.Params{
				params.ProcessID: {Name: params.ProcessID, Type: params.PID, Value: pid % 2},
			},
			Metadata: map[event.MetadataKey]any{"foo": "bar", "fooz": "barzz"},
		}
		e2 := &event.Event{
			Type:      event.CreateFile,
			Timestamp: time.Now().Add(time.Duration(i) * time.Millisecond * 2),
			Name:      "CreateFile",
			Tid:       2484,
			PID:       pid * 2,
			Category:  event.File,
			PS: &pstypes.PS{
				Name: "cmd.exe",
				Exe:  "C:\\Windows\\system32\\cmd.exe",
			},
			Params: event.Params{
				params.FilePath: {Name: params.FilePath, Type: params.UnicodeString, Value: "C:\\Windows\\system32\\svchost-temp.exe"},
			},
			Metadata: map[event.MetadataKey]any{"foo": "bar", "fooz": "barzz"},
		}
		require.False(t, ss.runSequence(e1))
		require.False(t, ss.runSequence(e2))
	}

	// expression matched multiple partials
	assert.Len(t, ss.partials[0], 5)
	assert.Len(t, ss.partials[1], 0)

	e1 := &event.Event{
		Seq:       20,