Function TestSequenceGC

pkg/rules/sequence_test.go:741–783

(t *testing.T)

}

func TestSequenceGC(t *testing.T) {
	log.SetLevel(log.DebugLevel)

	maxSequencePartialLifetime = time.Millisecond * 500

	c := &config.FilterConfig{Name: "LSASS memory dumping via legitimate or offensive tools"}
	f := filter.New(`
	sequence
  by ps.uuid
  	|evt.name = 'OpenProcess' and evt.arg[exe] imatches '?:\\Windows\\System32\\lsass.exe'|
		|evt.name = 'CreateFile' and file.operation = 'CREATE' and file.extension = '.dmp'|
	`, &config.Config{EventSource: config.EventSourceConfig{EnableFileIOEvents: true}, Filters: &config.Filters{}})
	require.NoError(t, f.Compile())

	ss := newSequenceState(f, c, new(ps.SnapshotterMock))

	e := &event.Event{
		Type:      event.OpenProcess,
		Timestamp: time.Now(),
		Name:      "OpenProcess",
		Tid:       2484,
		PID:       859,
		PS: &pstypes.PS{
			Name: "cmd.exe",
			Exe:  "C:\\Windows\\system32\\rundll32.exe",
		},
		Params: event.Params{
			params.Exe:           {Name: params.Exe, Type: params.UnicodeString, Value: "C:\\Windows\\System32\\lsass.exe"},
			params.ProcessID:     {Name: params.ProcessID, Type: params.PID, Value: uint32(2243)},
			params.DesiredAccess: {Name: params.DesiredAccess, Type: params.Flags, Value: uint32(0x1400), Flags: event.PsAccessRightFlags},
		},
		Metadata: map[event.MetadataKey]any{"foo": "bar", "fooz": "barzz"},
	}

	require.False(t, ss.runSequence(e))
	assert.Len(t, ss.partials[0], 1)

	time.Sleep(time.Second)

	ss.gc()

	assert.Len(t, ss.partials[0], 0)
}

func TestSequenceExpire(t *testing.T) {
	log.SetLevel(log.DebugLevel)