221 lines
9.1 KiB
Python
Executable file
221 lines
9.1 KiB
Python
Executable file
# SPDX-License-Identifier: GPL-3.0-or-later
|
|
"""Detector unit tests using injected fake state — no /proc, no root, no ss."""
|
|
import unittest
|
|
from dataclasses import dataclass, field
|
|
|
|
from enodia_sentinel.alert import Severity
|
|
from enodia_sentinel.config import Config
|
|
from enodia_sentinel.detectors import (
|
|
credential_access, deleted_exe, egress, input_snooper, ld_preload,
|
|
new_listener, new_suid, reverse_shell,
|
|
stealth_network,
|
|
)
|
|
from enodia_sentinel.system import Socket, SystemState
|
|
|
|
|
|
@dataclass
|
|
class FakeProc:
|
|
"""Duck-typed stand-in for system.Process."""
|
|
pid: int
|
|
comm: str = "bash"
|
|
cmdline: str = ""
|
|
exe: str = ""
|
|
environ: dict = field(default_factory=dict)
|
|
_stdio_inode: int | None = None
|
|
ppid: int = 1
|
|
uid: int = 0
|
|
cwd: str = "/"
|
|
fd_targets: dict = field(default_factory=dict)
|
|
|
|
def stdio_socket_inode(self):
|
|
return self._stdio_inode
|
|
|
|
|
|
def cfg() -> Config:
|
|
return Config()
|
|
|
|
|
|
class TestReverseShell(unittest.TestCase):
|
|
def test_interpreter_with_network_socket_alerts(self):
|
|
proc = FakeProc(pid=100, comm="bash", _stdio_inode=999,
|
|
cmdline="bash -i")
|
|
sock = Socket("ESTAB", "127.0.0.1:55", "9.9.9.9:443", 999, "bash", 100)
|
|
state = SystemState(processes=[proc], sockets=[sock])
|
|
alerts = list(reverse_shell.detect(state, cfg()))
|
|
self.assertEqual(len(alerts), 1)
|
|
self.assertEqual(alerts[0].signature, "reverse_shell")
|
|
self.assertEqual(alerts[0].severity, Severity.CRITICAL)
|
|
self.assertEqual(alerts[0].pids, (100,))
|
|
|
|
def test_non_interpreter_does_not_alert(self):
|
|
proc = FakeProc(pid=101, comm="nginx", _stdio_inode=999)
|
|
sock = Socket("ESTAB", "127.0.0.1:55", "9.9.9.9:443", 999, "nginx", 101)
|
|
state = SystemState(processes=[proc], sockets=[sock])
|
|
self.assertEqual(list(reverse_shell.detect(state, cfg())), [])
|
|
|
|
def test_unix_socket_stdio_does_not_alert(self):
|
|
# stdio socket inode not present in the network socket table => benign
|
|
proc = FakeProc(pid=102, comm="bash", _stdio_inode=777)
|
|
state = SystemState(processes=[proc], sockets=[])
|
|
self.assertEqual(list(reverse_shell.detect(state, cfg())), [])
|
|
|
|
|
|
class TestLdPreload(unittest.TestCase):
|
|
def test_writable_path_alerts(self):
|
|
proc = FakeProc(pid=200, comm="sleep",
|
|
environ={"LD_PRELOAD": "/tmp/evil.so"})
|
|
state = SystemState(processes=[proc])
|
|
alerts = list(ld_preload.detect(state, cfg()))
|
|
self.assertEqual(len(alerts), 1)
|
|
self.assertEqual(alerts[0].severity, Severity.CRITICAL)
|
|
|
|
def test_system_path_does_not_alert(self):
|
|
proc = FakeProc(pid=201, environ={"LD_PRELOAD": "/usr/lib/libfoo.so"})
|
|
state = SystemState(processes=[proc])
|
|
self.assertEqual(list(ld_preload.detect(state, cfg())), [])
|
|
|
|
|
|
class TestDeletedExe(unittest.TestCase):
|
|
def test_deleted_in_tmp_alerts(self):
|
|
proc = FakeProc(pid=300, comm="x", exe="/tmp/x (deleted)")
|
|
state = SystemState(processes=[proc])
|
|
self.assertEqual(len(list(deleted_exe.detect(state, cfg()))), 1)
|
|
|
|
def test_memfd_alerts(self):
|
|
proc = FakeProc(pid=301, comm="x", exe="/memfd:foo (deleted)")
|
|
state = SystemState(processes=[proc])
|
|
self.assertEqual(len(list(deleted_exe.detect(state, cfg()))), 1)
|
|
|
|
def test_deleted_system_path_ignored(self):
|
|
# daemon still running after a package upgrade — not fileless malware
|
|
proc = FakeProc(pid=302, comm="x", exe="/usr/bin/x (deleted)")
|
|
state = SystemState(processes=[proc])
|
|
self.assertEqual(list(deleted_exe.detect(state, cfg())), [])
|
|
|
|
|
|
class TestInputSnooper(unittest.TestCase):
|
|
def test_input_device_alerts(self):
|
|
proc = FakeProc(pid=320, comm="hoxha",
|
|
fd_targets={"7": "/dev/input/event3"})
|
|
alerts = list(input_snooper.detect(SystemState(processes=[proc]), cfg()))
|
|
self.assertEqual(len(alerts), 1)
|
|
self.assertEqual(alerts[0].signature, "input_snooper")
|
|
self.assertEqual(alerts[0].severity, Severity.HIGH)
|
|
|
|
def test_allowlisted_input_process_ignored(self):
|
|
proc = FakeProc(pid=321, comm="Xorg",
|
|
fd_targets={"7": "/dev/input/event3"})
|
|
self.assertEqual(list(input_snooper.detect(SystemState(processes=[proc]), cfg())), [])
|
|
|
|
|
|
class TestCredentialAccess(unittest.TestCase):
|
|
def test_shadow_access_alerts(self):
|
|
proc = FakeProc(pid=330, comm="hoxha",
|
|
fd_targets={"4": "/etc/shadow"})
|
|
alerts = list(credential_access.detect(SystemState(processes=[proc]), cfg()))
|
|
self.assertEqual(len(alerts), 1)
|
|
self.assertEqual(alerts[0].signature, "credential_access")
|
|
self.assertEqual(alerts[0].severity, Severity.CRITICAL)
|
|
|
|
def test_private_key_access_alerts(self):
|
|
proc = FakeProc(pid=331, comm="collector",
|
|
fd_targets={"5": "/home/luna/.ssh/id_ed25519"})
|
|
alerts = list(credential_access.detect(SystemState(processes=[proc]), cfg()))
|
|
self.assertEqual(len(alerts), 1)
|
|
self.assertIn("private SSH key", alerts[0].detail)
|
|
|
|
def test_browser_access_by_browser_ignored(self):
|
|
proc = FakeProc(
|
|
pid=332, comm="firefox",
|
|
fd_targets={"8": "/home/luna/.mozilla/firefox/a/key4.db"},
|
|
)
|
|
self.assertEqual(list(credential_access.detect(SystemState(processes=[proc]), cfg())), [])
|
|
|
|
|
|
class TestStealthNetwork(unittest.TestCase):
|
|
def test_sctp_public_peer_alerts(self):
|
|
sock = Socket("ESTAB", "10.0.0.2:5000", "8.8.8.8:4443",
|
|
1, "hoxha", 340, "sctp")
|
|
alerts = list(stealth_network.detect(SystemState(sockets=[sock]), cfg()))
|
|
self.assertEqual(len(alerts), 1)
|
|
self.assertEqual(alerts[0].signature, "stealth_network")
|
|
self.assertEqual(alerts[0].severity, Severity.HIGH)
|
|
|
|
def test_packet_socket_allowlisted_comm_ignored(self):
|
|
sock = Socket("UNCONN", "*:eth0", "*", 1, "tcpdump", 341, "packet")
|
|
self.assertEqual(list(stealth_network.detect(SystemState(sockets=[sock]), cfg())), [])
|
|
|
|
def test_allowlisted_kind_ignored(self):
|
|
c = Config()
|
|
c.stealth_network_allow_kinds = frozenset({"mptcp"})
|
|
sock = Socket("ESTAB", "10.0.0.2:5000", "8.8.8.8:443",
|
|
1, "curl", 342, "mptcp")
|
|
self.assertEqual(list(stealth_network.detect(SystemState(sockets=[sock]), c)), [])
|
|
|
|
def test_tcp_ignored(self):
|
|
sock = Socket("ESTAB", "10.0.0.2:5000", "8.8.8.8:443",
|
|
1, "python3", 343, "tcp")
|
|
self.assertEqual(list(stealth_network.detect(SystemState(sockets=[sock]), cfg())), [])
|
|
|
|
|
|
class TestNewSuid(unittest.TestCase):
|
|
def test_new_in_writable_is_critical(self):
|
|
state = SystemState(
|
|
suid_binaries=["/tmp/evil", "/usr/bin/sudo"],
|
|
suid_baseline={"/usr/bin/sudo"},
|
|
)
|
|
alerts = list(new_suid.detect(state, cfg()))
|
|
self.assertEqual(len(alerts), 1)
|
|
self.assertEqual(alerts[0].severity, Severity.CRITICAL)
|
|
self.assertIn("/tmp/evil", alerts[0].detail)
|
|
|
|
def test_new_in_system_path_is_high(self):
|
|
state = SystemState(
|
|
suid_binaries=["/usr/local/bin/newtool", "/usr/bin/sudo"],
|
|
suid_baseline={"/usr/bin/sudo"},
|
|
)
|
|
alerts = list(new_suid.detect(state, cfg()))
|
|
self.assertEqual(len(alerts), 1)
|
|
self.assertEqual(alerts[0].severity, Severity.HIGH)
|
|
|
|
def test_no_scan_no_alert(self):
|
|
state = SystemState(suid_binaries=None, suid_baseline={"/usr/bin/sudo"})
|
|
self.assertEqual(list(new_suid.detect(state, cfg())), [])
|
|
|
|
|
|
class TestEgress(unittest.TestCase):
|
|
def test_interpreter_to_public_alerts(self):
|
|
sock = Socket("ESTAB", "10.0.0.2:5000", "8.8.8.8:443", 1, "python3", 400)
|
|
state = SystemState(sockets=[sock])
|
|
alerts = list(egress.detect(state, cfg()))
|
|
self.assertEqual(len(alerts), 1)
|
|
|
|
def test_interpreter_to_private_ignored(self):
|
|
sock = Socket("ESTAB", "10.0.0.2:5000", "10.0.0.9:443", 1, "python3", 401)
|
|
state = SystemState(sockets=[sock])
|
|
self.assertEqual(list(egress.detect(state, cfg())), [])
|
|
|
|
def test_allowlisted_cidr_ignored(self):
|
|
c = Config()
|
|
c.egress_allow_cidrs = ("8.8.8.0/24",)
|
|
sock = Socket("ESTAB", "10.0.0.2:5000", "8.8.8.8:443", 1, "bash", 402)
|
|
state = SystemState(sockets=[sock])
|
|
self.assertEqual(list(egress.detect(state, c)), [])
|
|
|
|
|
|
class TestNewListener(unittest.TestCase):
|
|
def test_new_port_alerts(self):
|
|
sock = Socket("LISTEN", "0.0.0.0:31337", "0.0.0.0:*", 1, "nc", 500)
|
|
state = SystemState(sockets=[sock], listener_baseline=set())
|
|
alerts = list(new_listener.detect(state, cfg()))
|
|
self.assertEqual(len(alerts), 1)
|
|
self.assertEqual(alerts[0].severity, Severity.HIGH)
|
|
|
|
def test_baseline_port_ignored(self):
|
|
sock = Socket("LISTEN", "0.0.0.0:22", "0.0.0.0:*", 1, "sshd", 501)
|
|
state = SystemState(sockets=[sock], listener_baseline={"22/sshd"})
|
|
self.assertEqual(list(new_listener.detect(state, cfg())), [])
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|