64 lines
1.9 KiB
Go
64 lines
1.9 KiB
Go
// SPDX-License-Identifier: GPL-3.0-or-later
|
|
|
|
package events
|
|
|
|
import (
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func syscallEvent(name string, arg0, arg2 uint64) SyscallEvent {
|
|
return SyscallEvent{
|
|
PID: 10, PPID: 1, UID: 1000, Comm: "hoxha", Syscall: name,
|
|
Args: [6]uint64{arg0, 0, arg2},
|
|
}
|
|
}
|
|
|
|
func TestDefaultSyscallRulesMatchPython(t *testing.T) {
|
|
engine := DefaultSyscallRuleEngine()
|
|
tests := []struct {
|
|
event SyscallEvent
|
|
sid int
|
|
}{
|
|
{syscallEvent("mprotect", 0, 0x6), 100060},
|
|
{syscallEvent("mmap", 0, 0x7), 100061},
|
|
{syscallEvent("memfd_create", 0, 0), 100062},
|
|
{syscallEvent("ptrace", 16, 0), 100063},
|
|
{syscallEvent("ptrace", 0x4206, 0), 100063},
|
|
{syscallEvent("prctl", 22, 0), 100064},
|
|
{syscallEvent("seccomp", 0, 0), 100064},
|
|
{syscallEvent("process_vm_readv", 4242, 0), 100065},
|
|
{syscallEvent("process_vm_writev", 4242, 0), 100065},
|
|
{syscallEvent("mlock", 0, 0), 100066},
|
|
{syscallEvent("mlockall", 0, 0), 100066},
|
|
}
|
|
for _, test := range tests {
|
|
found := false
|
|
for _, alert := range engine.Match(test.event) {
|
|
if alert.SID == test.sid {
|
|
found = true
|
|
}
|
|
}
|
|
if !found {
|
|
t.Fatalf("sid %d did not match %#v", test.sid, test.event)
|
|
}
|
|
}
|
|
if alerts := engine.Match(syscallEvent("mprotect", 0, 0x5)); len(alerts) != 0 {
|
|
t.Fatalf("read+exec mprotect matched: %#v", alerts)
|
|
}
|
|
if alerts := engine.Match(syscallEvent("ptrace", 3, 0)); len(alerts) != 0 {
|
|
t.Fatalf("non-sensitive ptrace matched: %#v", alerts)
|
|
}
|
|
}
|
|
|
|
func TestSyscallAlertContract(t *testing.T) {
|
|
event := syscallEvent("memfd_create", 1, 0)
|
|
event.Text = "payload"
|
|
alert := DefaultSyscallRuleEngine().Match(event)[0]
|
|
if alert.SID != 100062 || alert.Severity != "MEDIUM" ||
|
|
alert.Signature != "syscall_rule.fileless-execution" ||
|
|
alert.Key != "syscall:100062:10:memfd_create:1:0" ||
|
|
!strings.Contains(alert.Detail, "args=[0x1, 0x0, 0x0, 0x0] text=[payload]") {
|
|
t.Fatalf("unexpected alert: %#v", alert)
|
|
}
|
|
}
|