Unit tests for mitre attack rules

packages/windows_open_package/correlation_rules/mitre_attck_comm_and_ctrl/RDP_Tunneling/tests/test_1.sc

@@ -0,0 +1,3 @@
+{"action": "login", "body": "{\"Event\":{\"xmlns\":\"http://schemas.microsoft.com/win/2004/08/events/event\",\"System\":{\"Provider\":{\"Name\":\"Microsoft-Windows-Security-Auditing\",\"Guid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\"},\"EventID\":\"4624\",\"Version\":\"0\",\"Level\":\"0\",\"Task\":\"12544\",\"Opcode\":\"0\",\"Keywords\":\"0x8020000000000000\",\"TimeCreated\":{\"SystemTime\":\"2019-02-13T15:26:53.3567809Z\"},\"EventRecordID\":\"5315\",\"Correlation\":\"\",\"Execution\":{\"ProcessID\":\"480\",\"ThreadID\":\"3952\"},\"Channel\":\"Security\",\"Computer\":\"PC02.example.corp\",\"Security\":\"\"},\"EventData\":{\"Data\":[{\"Name\":\"SubjectUserSid\",\"text\":\"S-1-5-18\"},{\"Name\":\"SubjectUserName\",\"text\":\"PC02$\"},{\"Name\":\"SubjectDomainName\",\"text\":\"EXAMPLE\"},{\"Name\":\"SubjectLogonId\",\"text\":\"0x3e7\"},{\"Name\":\"TargetUserSid\",\"text\":\"S-1-5-21-3583694148-1414552638-2922671848-1000\"},{\"Name\":\"TargetUserName\",\"text\":\"IEUser\"},{\"Name\":\"TargetDomainName\",\"text\":\"PC02\"},{\"Name\":\"TargetLogonId\",\"text\":\"0x45120\"},{\"Name\":\"LogonType\",\"text\":\"10\"},{\"Name\":\"LogonProcessName\",\"text\":\"User32\"},{\"Name\":\"AuthenticationPackageName\",\"text\":\"Negotiate\"},{\"Name\":\"WorkstationName\",\"text\":\"PC02\"},{\"Name\":\"LogonGuid\",\"text\":\"{00000000-0000-0000-0000-000000000000}\"},{\"Name\":\"TransmittedServices\",\"text\":\"-\"},{\"Name\":\"LmPackageName\",\"text\":\"-\"},{\"Name\":\"KeyLength\",\"text\":\"0\"},{\"Name\":\"ProcessId\",\"text\":\"0x658\"},{\"Name\":\"ProcessName\",\"text\":\"C:\\\\Windows\\\\System32\\\\winlogon.exe\"},{\"Name\":\"IpAddress\",\"text\":\"127.0.0.1\"},{\"Name\":\"IpPort\",\"text\":\"49164\"}]}}}", "category.generic": "Operating System", "category.high": "Access Management", "category.low": "Communication", "datafield6": "RemoteInteractive", "datafield9": "Negotiate", "dst.fqdn": "pc02.example.corp", "dst.host": "pc02.example.corp", "dst.hostname": "pc02", "event_src.category": "AAA", "event_src.fqdn": "pc02.example.corp", "event_src.host": "pc02.example.corp", "event_src.hostname": "pc02", "event_src.subsys": "Security", "event_src.title": "windows", "event_src.vendor": "microsoft", "generator.type": "logcollector", "generator.version": "N26.0.2936", "id": "PT_Microsoft_Windows_eventlog_4624_An_account_was_successfully_logged_on", "importance": "info", "input_id": "00000000-0000-0000-0000-000000000000", "logon_auth_method": "remote", "logon_service": "User32", "logon_type": 10, "mime": "application/x-pt-eventlog", "msgid": "4624", "normalized": true, "object": "system", "recv_ipv4": "127.0.0.1", "recv_time": "2023-06-04T21:05:50.597Z", "src.host": "127.0.0.1", "src.ip": "127.0.0.1", "src.port": 49164, "status": "success", "subject": "account", "subject.account.domain": "pc02", "subject.account.id": "S-1-5-21-3583694148-1414552638-2922671848-1000", "subject.account.name": "ieuser", "subject.account.session_id": "282912", "subject.process.fullpath": "c:\\windows\\system32\\winlogon.exe", "subject.process.id": "1624", "subject.process.name": "winlogon.exe", "subject.process.path": "c:\\windows\\system32\\", "tag": "some_tag", "task_id": "00000000-0000-0000-0000-000000000000", "taxonomy_version": "26.0.215-release-26.0", "time": "2019-02-13T15:26:53.356Z", "type": "raw", "uuid": "8a33a9cc-4609-43b5-aa3f-4d468a296ce2"}
+
+expect 1 {"action": "login", "category.generic": "Attack", "category.high": "Command and Control", "category.low": "Protocol Tunneling", "correlation_name": "RDP_Tunneling", "correlation_type": "incident", "dst.fqdn": "pc02.example.corp", "dst.host": "pc02.example.corp", "dst.hostname": "pc02", "event_src.category": "AAA", "event_src.host": "pc02.example.corp", "event_src.hostname": "pc02", "event_src.subsys": "Security", "event_src.title": "windows", "event_src.vendor": "microsoft", "importance": "medium", "incident.category": "Undefined", "incident.severity": "medium", "logon_auth_method": "remote", "logon_service": "User32", "logon_type": 10, "object": "system", "src.host": "127.0.0.1", "src.ip": "127.0.0.1", "src.port": 49164, "status": "success", "subject": "account", "subject.account.domain": "pc02", "subject.account.id": "S-1-5-21-3583694148-1414552638-2922671848-1000", "subject.account.name": "ieuser", "subject.account.session_id": "282912", "subject.process.fullpath": "c:\\windows\\system32\\winlogon.exe", "subject.process.id": "1624", "subject.process.name": "winlogon.exe", "subject.process.path": "c:\\windows\\system32\\"}

packages/windows_open_package/correlation_rules/mitre_attck_comm_and_ctrl/RDP_Tunneling/tests/test_2.sc

@@ -0,0 +1,3 @@
+{"action": "login", "body": "{\"Event\":{\"xmlns\":\"http://schemas.microsoft.com/win/2004/08/events/event\",\"System\":{\"Provider\":{\"Name\":\"Microsoft-Windows-TerminalServices-RemoteConnectionManager\",\"Guid\":\"{c76baa63-ae81-421c-b425-340b4b24157f}\"},\"EventID\":\"1149\",\"Version\":\"0\",\"Level\":\"4\",\"Task\":\"0\",\"Opcode\":\"0\",\"Keywords\":\"0x1000000000000000\",\"TimeCreated\":{\"SystemTime\":\"2019-02-13T18:04:57.4523864Z\"},\"EventRecordID\":\"228\",\"Correlation\":\"\",\"Execution\":{\"ProcessID\":\"1280\",\"ThreadID\":\"2748\"},\"Channel\":\"Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational\",\"Computer\":\"PC01.example.corp\",\"Security\":{\"UserID\":\"S-1-5-20\"}},\"UserData\":{\"EventXML\":{\"xmlns:auto-ns2\":\"2>http://schemas.microsoft.com/win/2004/08/events\",\"xmlns\":\"Event_NS\",\"Param1\":\"admin01\",\"Param2\":\"example\",\"Param3\":\"127.0.0.1\"}}}}", "category.generic": "Access", "category.high": "Authentication", "category.low": "Remote", "event_src.category": "Terminal services", "event_src.fqdn": "pc01.example.corp", "event_src.host": "pc01.example.corp", "event_src.hostname": "pc01", "event_src.subsys": "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational", "event_src.title": "windows", "event_src.vendor": "microsoft", "generator.type": "logcollector", "generator.version": "N26.0.2936", "id": "1149_User_authentication_succeeded", "importance": "info", "input_id": "00000000-0000-0000-0000-000000000000", "mime": "application/x-pt-eventlog", "msgid": "1149", "normalized": true, "object": "system", "recv_ipv4": "127.0.0.1", "recv_time": "2023-06-04T21:55:11.504Z", "src.host": "127.0.0.1", "src.ip": "127.0.0.1", "status": "success", "subject": "account", "subject.account.domain": "example", "subject.account.name": "admin01", "tag": "some_tag", "task_id": "00000000-0000-0000-0000-000000000000", "taxonomy_version": "26.0.215-release-26.0", "time": "2019-02-13T18:04:57.452Z", "type": "raw", "uuid": "8b82ace1-015d-45a5-8be0-552b37fceb60"}
+
+expect 1								{"action": "login", "category.generic": "Attack", "category.high": "Command and Control", "category.low": "Protocol Tunneling", "correlation_name": "RDP_Tunneling", "correlation_type": "incident", "event_src.category": "Terminal services", "event_src.host": "pc01.example.corp", "event_src.hostname": "pc01", "event_src.subsys": "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational", "event_src.title": "windows", "event_src.vendor": "microsoft", "importance": "medium", "incident.category": "Undefined", "incident.severity": "medium", "object": "system", "src.host": "127.0.0.1", "src.ip": "127.0.0.1", "status": "success", "subject": "account", "subject.account.domain": "example", "subject.account.name": "admin01"}

packages/windows_open_package/correlation_rules/mitre_attck_comm_and_ctrl/RDP_Tunneling_via_SSH_5156/tests/test_1.sc

@@ -0,0 +1,3 @@
+{"action": "allow", "body": "{\"Event\":{\"xmlns\":\"http://schemas.microsoft.com/win/2004/08/events/event\",\"System\":{\"Provider\":{\"Name\":\"Microsoft-Windows-Security-Auditing\",\"Guid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\"},\"EventID\":\"5156\",\"Version\":\"1\",\"Level\":\"0\",\"Task\":\"12810\",\"Opcode\":\"0\",\"Keywords\":\"0x8020000000000000\",\"TimeCreated\":{\"SystemTime\":\"2019-02-13T18:04:01.6321208Z\"},\"EventRecordID\":\"227727\",\"Correlation\":\"\",\"Execution\":{\"ProcessID\":\"4\",\"ThreadID\":\"56\"},\"Channel\":\"Security\",\"Computer\":\"PC01.example.corp\",\"Security\":\"\"},\"EventData\":{\"Data\":[{\"Name\":\"ProcessID\",\"text\":\"3324\"},{\"Name\":\"Application\",\"text\":\"\\\\device\\\\harddiskvolume1\\\\users\\\\user01\\\\desktop\\\\plink.exe\"},{\"Name\":\"Direction\",\"text\":\"%%14593\"},{\"Name\":\"SourceAddress\",\"text\":\"127.0.0.1\"},{\"Name\":\"SourcePort\",\"text\":\"49271\"},{\"Name\":\"DestAddress\",\"text\":\"127.0.0.2\"},{\"Name\":\"DestPort\",\"text\":\"3389\"},{\"Name\":\"Protocol\",\"text\":\"6\"},{\"Name\":\"FilterRTID\",\"text\":\"0\"},{\"Name\":\"LayerName\",\"text\":\"%%14611\"},{\"Name\":\"LayerRTID\",\"text\":\"48\"},{\"Name\":\"RemoteUserID\",\"text\":\"S-1-0-0\"},{\"Name\":\"RemoteMachineID\",\"text\":\"S-1-0-0\"}]}}}", "category.generic": "Connection", "category.high": "Network Interaction Management", "category.low": "Control", "datafield5": "48", "direction": "egress", "dst.host": "127.0.0.2", "dst.ip": "127.0.0.2", "dst.port": 3389, "event_src.category": "Operating system", "event_src.fqdn": "pc01.example.corp", "event_src.host": "pc01.example.corp", "event_src.hostname": "pc01", "event_src.subsys": "Security", "event_src.title": "windows", "event_src.vendor": "microsoft", "generator.type": "logcollector", "generator.version": "N26.0.2936", "id": "PT_Microsoft_Windows_eventlog_5156_WFP_has_permitted_connection", "importance": "info", "input_id": "00000000-0000-0000-0000-000000000000", "mime": "application/x-pt-eventlog", "msgid": "5156", "normalized": true, "object": "connection", "object.process.fullpath": "\\device\\harddiskvolume1\\users\\user01\\desktop\\plink.exe", "object.process.id": "3324", "object.process.name": "plink.exe", "object.process.path": "\\device\\harddiskvolume1\\users\\user01\\desktop\\", "object.property": "ALE layer", "object.value": "Connect", "protocol": "6", "recv_ipv4": "127.0.0.1", "recv_time": "2023-06-12T21:30:19.331Z", "src.host": "127.0.0.1", "src.ip": "127.0.0.1", "src.port": 49271, "status": "success", "subject": "rule", "subject.id": "0", "tag": "some_tag", "task_id": "00000000-0000-0000-0000-000000000000", "taxonomy_version": "26.0.215-release-26.0", "time": "2019-02-13T18:04:01.632Z", "type": "raw", "uuid": "dc4c60bd-251a-4238-94bb-1d308a36fb43"}
+
+expect 1 								{"action": "start", "category.generic": "Attack", "category.high": "Command and Control", "category.low": "Protocol Tunneling", "correlation_name": "RDP_Tunneling_via_SSH_5156", "correlation_type": "event", "direction": "egress", "dst.host": "127.0.0.2", "dst.ip": "127.0.0.2", "dst.port": 3389, "event_src.category": "Operating system", "event_src.fqdn": "pc01.example.corp", "event_src.host": "pc01.example.corp", "event_src.hostname": "pc01", "event_src.subsys": "Security", "event_src.title": "windows", "event_src.vendor": "microsoft", "importance": "high", "object": "process", "object.process.fullpath": "\\device\\harddiskvolume1\\users\\user01\\desktop\\plink.exe", "object.process.id": "3324", "object.process.name": "plink.exe", "object.process.path": "\\device\\harddiskvolume1\\users\\user01\\desktop\\", "protocol": "6", "src.host": "127.0.0.1", "src.ip": "127.0.0.1", "src.port": 49271, "status": "success", "subject": "account"}

packages/windows_open_package/correlation_rules/mitre_attck_cred_access/Chrome_firefox_opera_cred_read/tests/test_1.sc

@@ -0,0 +1,4 @@
+{"action": "access", "body": "{\"Event\":{\"xmlns\":\"http://schemas.microsoft.com/win/2004/08/events/event\",\"System\":{\"Provider\":{\"Name\":\"Microsoft-Windows-Security-Auditing\",\"Guid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\"},\"EventID\":\"4663\",\"Version\":\"0\",\"Level\":\"0\",\"Task\":\"12800\",\"Opcode\":\"0\",\"Keywords\":\"0x8020000000000000\",\"TimeCreated\":{\"SystemTime\":\"2019-04-27T19:33:05.3081880Z\"},\"EventRecordID\":\"4989\",\"Correlation\":\"\",\"Execution\":{\"ProcessID\":\"4\",\"ThreadID\":\"56\"},\"Channel\":\"Security\",\"Computer\":\"IEWIN7\",\"Security\":\"\"},\"EventData\":{\"Data\":[{\"Name\":\"SubjectUserSid\",\"text\":\"S-1-5-21-3583694148-1414552638-2922671848-1000\"},{\"Name\":\"SubjectUserName\",\"text\":\"IEUser\"},{\"Name\":\"SubjectDomainName\",\"text\":\"IEWIN7\"},{\"Name\":\"SubjectLogonId\",\"text\":\"0xffa8\"},{\"Name\":\"ObjectServer\",\"text\":\"Security\"},{\"Name\":\"ObjectType\",\"text\":\"File\"},{\"Name\":\"ObjectName\",\"text\":\"C:\\\\Users\\\\IEUser\\\\AppData\\\\Roaming\\\\Mozilla\\\\Firefox\\\\Profiles\\\\kushu3sd.default\\\\key4.db\"},{\"Name\":\"HandleId\",\"text\":\"0x50\"},{\"Name\":\"AccessList\",\"text\":\"%%4416\"},{\"Name\":\"AccessMask\",\"text\":\"0x1\"},{\"Name\":\"ProcessId\",\"text\":\"0x134c\"},{\"Name\":\"ProcessName\",\"text\":\"C:\\\\Users\\\\Defau1t\\\\wsus.exe\"}]}}}", "category.generic": "File System Object", "category.high": "System Management", "category.low": "Manipulation", "datafield1": "0x50", "datafield5": "0x1", "event_src.category": "Operating system", "event_src.fqdn": "iewin7", "event_src.host": "iewin7", "event_src.hostname": "iewin7", "event_src.subsys": "Security", "event_src.title": "windows", "event_src.vendor": "microsoft", "generator.type": "logcollector", "generator.version": "N26.0.2936", "id": "PT_Microsoft_Windows_eventlog_4663_An_attempt_was_made_to_access_an_object", "importance": "info", "input_id": "00000000-0000-0000-0000-000000000000", "mime": "application/x-pt-eventlog", "msgid": "4663", "normalized": true, "object": "file_object", "object.fullpath": "c:\\users\\ieuser\\appdata\\roaming\\mozilla\\firefox\\profiles\\kushu3sd.default\\key4.db", "object.name": "key4.db", "object.path": "c:\\users\\ieuser\\appdata\\roaming\\mozilla\\firefox\\profiles\\kushu3sd.default\\", "object.property": "GrantedAccess", "object.type": "file", "object.value": "0x1", "recv_ipv4": "127.0.0.1", "recv_time": "2023-06-04T11:47:59.229Z", "status": "success", "subject": "account", "subject.account.domain": "iewin7", "subject.account.id": "S-1-5-21-3583694148-1414552638-2922671848-1000", "subject.account.name": "ieuser", "subject.account.privileges": "%%4416", "subject.account.session_id": "65448", "subject.process.fullpath": "C:\\Users\\Defau1t\\wsus.exe", "subject.process.id": "4940", "subject.process.name": "wsus.exe", "subject.process.path": "C:\\Users\\Defau1t\\", "tag": "some_tag", "task_id": "00000000-0000-0000-0000-000000000000", "taxonomy_version": "26.0.215-release-26.0", "time": "2019-04-27T19:33:05.308Z", "type": "raw", "uuid": "ab468aaa-cc07-45a7-b407-d7cd53928174"}
+{"action": "access", "body": "{\"Event\":{\"xmlns\":\"http://schemas.microsoft.com/win/2004/08/events/event\",\"System\":{\"Provider\":{\"Name\":\"Microsoft-Windows-Security-Auditing\",\"Guid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\"},\"EventID\":\"4663\",\"Version\":\"0\",\"Level\":\"0\",\"Task\":\"12800\",\"Opcode\":\"0\",\"Keywords\":\"0x8020000000000000\",\"TimeCreated\":{\"SystemTime\":\"2019-04-27T19:33:18.6997552Z\"},\"EventRecordID\":\"4990\",\"Correlation\":\"\",\"Execution\":{\"ProcessID\":\"4\",\"ThreadID\":\"56\"},\"Channel\":\"Security\",\"Computer\":\"IEWIN7\",\"Security\":\"\"},\"EventData\":{\"Data\":[{\"Name\":\"SubjectUserSid\",\"text\":\"S-1-5-21-3583694148-1414552638-2922671848-1000\"},{\"Name\":\"SubjectUserName\",\"text\":\"IEUser\"},{\"Name\":\"SubjectDomainName\",\"text\":\"IEWIN7\"},{\"Name\":\"SubjectLogonId\",\"text\":\"0xffa8\"},{\"Name\":\"ObjectServer\",\"text\":\"Security\"},{\"Name\":\"ObjectType\",\"text\":\"File\"},{\"Name\":\"ObjectName\",\"text\":\"C:\\\\Users\\\\IEUser\\\\AppData\\\\Roaming\\\\Mozilla\\\\Firefox\\\\Profiles\\\\kushu3sd.default\\\\logins.json\"},{\"Name\":\"HandleId\",\"text\":\"0x50\"},{\"Name\":\"AccessList\",\"text\":\"%%4416\"},{\"Name\":\"AccessMask\",\"text\":\"0x1\"},{\"Name\":\"ProcessId\",\"text\":\"0x134c\"},{\"Name\":\"ProcessName\",\"text\":\"C:\\\\Users\\\\Defau1t\\\\wsus.exe\"}]}}}", "category.generic": "File System Object", "category.high": "System Management", "category.low": "Manipulation", "datafield1": "0x50", "datafield5": "0x1", "event_src.category": "Operating system", "event_src.fqdn": "iewin7", "event_src.host": "iewin7", "event_src.hostname": "iewin7", "event_src.subsys": "Security", "event_src.title": "windows", "event_src.vendor": "microsoft", "generator.type": "logcollector", "generator.version": "N26.0.2936", "id": "PT_Microsoft_Windows_eventlog_4663_An_attempt_was_made_to_access_an_object", "importance": "info", "input_id": "00000000-0000-0000-0000-000000000000", "mime": "application/x-pt-eventlog", "msgid": "4663", "normalized": true, "object": "file_object", "object.fullpath": "c:\\users\\ieuser\\appdata\\roaming\\mozilla\\firefox\\profiles\\kushu3sd.default\\logins.json", "object.name": "logins.json", "object.path": "c:\\users\\ieuser\\appdata\\roaming\\mozilla\\firefox\\profiles\\kushu3sd.default\\", "object.property": "GrantedAccess", "object.type": "file", "object.value": "0x1", "recv_ipv4": "127.0.0.1", "recv_time": "2023-06-04T11:47:59.230Z", "status": "success", "subject": "account", "subject.account.domain": "iewin7", "subject.account.id": "S-1-5-21-3583694148-1414552638-2922671848-1000", "subject.account.name": "ieuser", "subject.account.privileges": "%%4416", "subject.account.session_id": "65448", "subject.process.fullpath": "C:\\Users\\Defau1t\\wsus.exe", "subject.process.id": "4940", "subject.process.name": "wsus.exe", "subject.process.path": "C:\\Users\\Defau1t\\", "tag": "some_tag", "task_id": "00000000-0000-0000-0000-000000000000", "taxonomy_version": "26.0.215-release-26.0", "time": "2019-04-27T19:33:18.699Z", "type": "raw", "uuid": "1594673e-8a1f-41aa-81af-dd9dc3f73331"}
+
+expect 2 {"action": "read", "alert.key": "C:\\Users\\Defau1t\\wsus.exe", "category.generic": "Attack", "category.high": "Credential Access", "category.low": "Credentials from Password Stores", "correlation_name": "Chrome_firefox_opera_cred_read", "correlation_type": "incident", "event_src.category": "Operating system", "event_src.host": "iewin7", "event_src.hostname": "iewin7", "event_src.title": "windows", "event_src.vendor": "microsoft", "importance": "medium", "object": "file", "object.path": "c:\\users\\ieuser\\appdata\\roaming\\mozilla\\firefox\\profiles\\kushu3sd.default\\", "object.property": "GrantedAccess", "object.type": "file", "object.value": "0x1", "status": "success", "subject": "account", "subject.account.domain": "iewin7", "subject.account.id": "S-1-5-21-3583694148-1414552638-2922671848-1000", "subject.account.name": "ieuser", "subject.account.privileges": "%%4416", "subject.account.session_id": "65448", "subject.process.fullpath": "C:\\Users\\Defau1t\\wsus.exe", "subject.process.id": "4940", "subject.process.name": "wsus.exe", "subject.process.path": "C:\\Users\\Defau1t\\"}