Function TestSequenceBoundFieldsWithFunctions

pkg/rules/sequence_test.go:1019–1083

(t *testing.T)

}

func TestSequenceBoundFieldsWithFunctions(t *testing.T) {
	log.SetLevel(log.DebugLevel)

	maxSequencePartialLifetime = time.Millisecond * 500

	c := &config.FilterConfig{Name: "Command shell created a temp file with network outbound"}
	f := filter.New(`
 	sequence
  maxspan 5m
    |evt.name = 'CreateFile' and file.path imatches '?:\\Windows\\System32\\*.dll'| as e1
    |evt.name = 'RegSetValue' and registry.path ~= 'HKEY_CURRENT_USER\\Volatile Environment\\Notification Packages' 
			and 
		 get_reg_value(registry.path) iin (base($e1.file.path, false))|
	`, &config.Config{EventSource: config.EventSourceConfig{EnableFileIOEvents: true, EnableRegistryEvents: true}, Filters: &config.Filters{}})
	require.NoError(t, f.Compile())

	ss := newSequenceState(f, c, new(ps.SnapshotterMock))

	e1 := &event.Event{
		Type:      event.CreateFile,
		Name:      "CreateFile",
		Category:  event.File,
		Timestamp: time.Now(),
		Tid:       2484,
		PID:       859,
		PS: &pstypes.PS{
			Name: "cmd.exe",
			Exe:  "C:\\Windows\\system32\\cmd.exe",
		},
		Params: event.Params{
			params.FilePath: {Name: params.FilePath, Type: params.UnicodeString, Value: "C:\\Windows\\System32\\passwdflt.dll"},
		},
		Metadata: map[event.MetadataKey]any{"foo": "bar", "fooz": "barzz"},
	}

	e2 := &event.Event{
		Type:      event.RegSetValue,
		Name:      "RegSetValue",
		Category:  event.Registry,
		Timestamp: time.Now().Add(time.Millisecond * 5),
		Tid:       2484,
		PID:       859,
		PS: &pstypes.PS{
			Name: "cmd.exe",
			Exe:  "C:\\Windows\\system32\\cmd.exe",
		},
		Params: event.Params{
			params.RegPath: {Name: params.RegPath, Type: params.UnicodeString, Value: "HKEY_CURRENT_USER\\Volatile Environment\\Notification Packages"},
		},
		Metadata: map[event.MetadataKey]any{"foo": "bar", "fooz": "barzz"},
	}

	key, err := registry.OpenKey(registry.CURRENT_USER, "Volatile Environment", registry.SET_VALUE)
	require.NoError(t, err)
	defer key.Close()

	defer func() {
		_ = key.DeleteValue("Notification Packages")