Function TestInterpolateFields

pkg/filter/filter_test.go:1407–1540

(t *testing.T)

}

func TestInterpolateFields(t *testing.T) {
	var tests = []struct {
		original     string
		interpolated string
		evts         []*event.Event
	}{
		{
			original:     "Credential discovery via %ps.name (%evt.arg[cmdline]) and user %ps.sid",
			interpolated: "Credential discovery via VaultCmd.exe (VaultCmd.exe /listcreds:Windows Credentials /all) and user LOCAL\\tor",
			evts: []*event.Event{
				{
					Type:     event.CreateProcess,
					Category: event.Process,
					Name:     "CreateProcess",
					PID:      1023,
					PS: &pstypes.PS{
						Name: "VaultCmd.exe",
						Ppid: 345,
						SID:  "LOCAL\\tor",
					},
					Params: event.Params{
						params.Cmdline: {Name: params.Cmdline, Type: params.UnicodeString, Value: `VaultCmd.exe /listcreds:Windows Credentials /all`},
					},
				},
			},
		},
		{
			original:     "Credential discovery via %ps.name and pid %evt.pid",
			interpolated: "Credential discovery via N/A and pid 1023",
			evts: []*event.Event{
				{
					Type:     event.CreateProcess,
					Category: event.Process,
					Name:     "CreateProcess",
					PID:      1023,
				},
			},
		},
		{
			original:     "Suspicious thread start module %thread.start_address.module",
			interpolated: "Suspicious thread start module C:\\Windows\\System32\\vault.dll",
			evts: []*event.Event{
				{
					Type:     event.CreateThread,
					Category: event.Thread,
					Name:     "CreateThread",
					PID:      1023,
					Params: event.Params{
						params.StartAddressModule: {Name: params.StartAddressModule, Type: params.UnicodeString, Value: "C:\\Windows\\System32\\vault.dll"},
					},
				},
			},
		},
		{
			original: `Detected an attempt by <code>%1.ps.name</code> process to access
and read the memory of the <b>Local Security And Authority Subsystem Service</b>
and subsequently write the <code>%2.file.path</code> dump file to the disk device`,
			interpolated: `Detected an attempt by <code>taskmgr.exe</code> process to access