Function TestSequenceBoundFields

pkg/rules/sequence_test.go:925–1017

(t *testing.T)

}

func TestSequenceBoundFields(t *testing.T) {
	log.SetLevel(log.DebugLevel)

	maxSequencePartialLifetime = time.Millisecond * 500

	c := &config.FilterConfig{Name: "Command shell created a temp file with network outbound"}
	f := filter.New(`
	sequence
  maxspan 200ms
  	|evt.name = 'CreateProcess' and ps.name = 'cmd.exe'| as e1
  	|evt.name = 'CreateFile' and file.path icontains 'temp' and $e1.ps.sid = ps.sid| as e2
  	|evt.name = 'Connect' and ps.sid != $e2.ps.sid and ps.sid = $e1.ps.sid|
	`, &config.Config{EventSource: config.EventSourceConfig{EnableFileIOEvents: true}, Filters: &config.Filters{}})
	require.NoError(t, f.Compile())

	ss := newSequenceState(f, c, new(ps.SnapshotterMock))

	e1 := &event.Event{
		Type:      event.CreateProcess,
		Timestamp: time.Now(),
		Name:      "CreateProcess",
		Tid:       2484,
		PID:       859,
		PS: &pstypes.PS{
			Name: "cmd.exe",
			Exe:  "C:\\Windows\\system32\\svchost-temp.exe",
			SID:  "zinet",
		},
		Params: event.Params{
			params.ProcessID: {Name: params.ProcessID, Type: params.Uint32, Value: uint32(4143)},
		},
		Metadata: map[event.MetadataKey]any{"foo": "bar", "fooz": "barzz"},
	}

	e2 := &event.Event{
		Type:      event.CreateProcess,
		Timestamp: time.Now().Add(time.Millisecond * 20),
		Name:      "CreateProcess",
		Tid:       2484,
		PID:       859,
		PS: &pstypes.PS{
			Name: "cmd.exe",
			Exe:  "C:\\Windows\\system32\\svchost-temp.exe",
			SID:  "nusret",
		},
		Params: event.Params{
			params.ProcessID: {Name: params.ProcessID, Type: params.Uint32, Value: uint32(4143)},
		},
		Metadata: map[event.MetadataKey]any{"foo": "bar", "fooz": "barzz"},
	}

	e3 := &event.Event{
		Type:      event.CreateFile,
		Timestamp: time.Now().Add(time.Second),
		Name:      "CreateFile",
		Tid:       2484,
		PID:       859,
		Category:  event.File,