Function TestSequenceExpire

pkg/rules/sequence_test.go:785–923

(t *testing.T)

}

func TestSequenceExpire(t *testing.T) {
	log.SetLevel(log.DebugLevel)

	var tests = []struct {
		c     *config.FilterConfig
		expr  string
		evts  []*event.Event
		wants bool
	}{
		{
			&config.FilterConfig{Name: "LSASS memory dumping via legitimate or offensive tools"},
			`sequence
  		 maxspan 2m
  			|evt.name = 'OpenProcess' and evt.arg[exe] imatches '?:\\Windows\\System32\\lsass.exe'| by ps.uuid
				|evt.name = 'CreateFile' and file.operation = 'CREATE' and file.extension = '.dmp'| by ps.uuid
			`,
			[]*event.Event{
				{
					Type:      event.OpenProcess,
					Timestamp: time.Now(),
					Name:      "OpenProcess",
					Tid:       2484,
					PID:       4143,
					PS: &pstypes.PS{
						Name: "cmd.exe",
						Exe:  "C:\\Windows\\system32\\rundll32.exe",
					},
					Params: event.Params{
						params.Exe:           {Name: params.Exe, Type: params.UnicodeString, Value: "C:\\Windows\\System32\\lsass.exe"},
						params.ProcessID:     {Name: params.ProcessID, Type: params.PID, Value: uint32(2243)},
						params.DesiredAccess: {Name: params.DesiredAccess, Type: params.Flags, Value: uint32(0x1400), Flags: event.PsAccessRightFlags},
					},
					Metadata: map[event.MetadataKey]any{"foo": "bar", "fooz": "barzz"},
				},
				{
					Type: event.TerminateProcess,
					Name: "TerminateProcess",
					Tid:  2484,
					PID:  859,
					PS: &pstypes.PS{
						Name: "cmd.exe",
						Exe:  "C:\\Windows\\system32\\svchost.exe",
					},
					Params: event.Params{
						params.ProcessID:   {Name: params.ProcessID, Type: params.PID, Value: uint32(4143)},
						params.ProcessName: {Name: params.ProcessName, Type: params.AnsiString, Value: "powershell.exe"},
					},
				},
			},
			true,
		},
		{
			&config.FilterConfig{Name: "System Binary Proxy Execution via Rundll32"},
			`sequence
  		 maxspan 2m
  			|evt.name = 'CreateProcess' and ps.name = 'rundll32.exe'| by ps.pid
				|evt.name = 'CreateProcess' and ps.name = 'connhost.exe'| by ps.parent.pid
			`,