Function TestScannerProcessEvent

internal/evasion/scanner_test.go:33–76

(t *testing.T)

)

func TestScannerProcessEvent(t *testing.T) {
	var tests = []struct {
		evt              *event.Event
		expectedEvasions []string
	}{
		{&event.Event{
			Type:      event.CreateFile,
			Tid:       2484,
			PID:       859,
			CPU:       1,
			Seq:       2,
			Name:      "CreateFile",
			Timestamp: time.Now(),
			Category:  event.File,
			Metadata:  event.Metadata{},
			Params: event.Params{
				params.FileObject:    {Name: params.FileObject, Type: params.Uint64, Value: uint64(12456738026482168384)},
				params.FilePath:      {Name: params.FilePath, Type: params.UnicodeString, Value: "C:\\Windows\\system32\\user32.dll"},
				params.FileType:      {Name: params.FileType, Type: params.AnsiString, Value: "file"},
				params.FileOperation: {Name: params.FileOperation, Type: params.Enum, Value: uint32(2), Enum: fs.FileCreateDispositions},
			},
			Callstack: callstackFromFrames(
				callstack.Frame{Addr: 0xf259de, Module: "unbacked", Symbol: "?"},
				callstack.Frame{Addr: 0x7ffe4fda6e3b, Module: "C:\\Windows\\System32\\KernelBase.dll", Symbol: "SetThreadContext"},
				callstack.Frame{Addr: 0xfffff807e228c555, Module: "C:\\WINDOWS\\system32\\ntoskrnl.exe", Symbol: "setjmpex"},
				callstack.Frame{Addr: 0xfffff807e264805c, Module: "C:\\WINDOWS\\system32\\ntoskrnl.exe", Symbol: "ObOpenObjectByPointerWithTag"}),
		}, []string{"direct_syscall"}},
	}

	s := NewScanner(Config{Enabled: true, EnableDirectSyscall: true})

	for _, tt := range tests {
		t.Run(strings.Join(tt.expectedEvasions, ","), func(t *testing.T) {
			matches, err := s.ProcessEvent(tt.evt)
			require.NoError(t, err)
			require.True(t, matches && len(tt.expectedEvasions) > 0)
			if len(tt.expectedEvasions) > 0 {
				require.True(t, tt.evt.Evasions&uint32(DirectSyscall) != 0)
				require.True(t, tt.evt.ContainsMeta(event.EvasionsKey))
				require.Equal(t, tt.expectedEvasions, tt.evt.GetMeta(event.EvasionsKey).([]string))
			}
		})
	}
}