Skip to content

Commit 0677c5e

Browse files
rabbitstackrabbitstack
committed
refactor(filter): Introduce *.path filter fields
Historically, the file.name/image.name/registry.key.name filter fields were used to yield the full file path, image path, or registry key respectively. However, a better way to convey the referenced field is actually returning a fully-qualified path is to introduce a new set of fields. As a side effect, the previous fields return the base file/image/key names.
1 parent efdd5e3 commit 0677c5e

File tree

4 files changed

+11
-11
lines changed

4 files changed

+11
-11
lines changed

‎pkg/aggregator/transformers/replace/replace_test.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -34,17 +34,17 @@ func TestTransform(t *testing.T) {
3434
Tid: 2484,
3535
PID: 859,
3636
Kparams: kevent.Kparams{
37-
kparams.RegKeyName: {Name: kparams.RegKeyName, Type: kparams.UnicodeString, Value: `HKEY_LOCAL_MACHINE\SYSTEM\Setup\Pid`},
37+
kparams.RegPath: {Name: kparams.RegPath, Type: kparams.UnicodeString, Value: `HKEY_LOCAL_MACHINE\SYSTEM\Setup\Pid`},
3838
kparams.RegKeyHandle: {Name: kparams.RegKeyHandle, Type: kparams.Address, Value: uint64(18446666033449935464)},
3939
},
4040
}
4141

42-
transf, err := transformers.Load(transformers.Config{Type: transformers.Replace, Transformer: Config{Replacements: []Replacement{{Kpar: "key_name", Old: "HKEY_LOCAL_MACHINE", New: "HKLM"}}}})
42+
transf, err := transformers.Load(transformers.Config{Type: transformers.Replace, Transformer: Config{Replacements: []Replacement{{Kpar: "key_path", Old: "HKEY_LOCAL_MACHINE", New: "HKLM"}}}})
4343
require.NoError(t, err)
4444

4545
require.NoError(t, transf.Transform(kevt))
4646

47-
keyName, _ := kevt.Kparams.GetString(kparams.RegKeyName)
47+
keyName, _ := kevt.Kparams.GetString(kparams.RegPath)
4848

4949
assert.Equal(t, `HKLM\SYSTEM\Setup\Pid`, keyName)
5050
}

‎pkg/aggregator/transformers/trim/trim_test.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ func TestTransform(t *testing.T) {
4242
Description: "Creates or opens a new file, directory, I/O device, pipe, console",
4343
Kparams: kevent.Kparams{
4444
kparams.FileObject: {Name: kparams.FileObject, Type: kparams.Uint64, Value: uint64(12456738026482168384)},
45-
kparams.FileName: {Name: kparams.FileName, Type: kparams.UnicodeString, Value: "\\Device\\HarddiskVolume2\\Windows\\system32\\user32.dll"},
45+
kparams.FilePath: {Name: kparams.FilePath, Type: kparams.UnicodeString, Value: "\\Device\\HarddiskVolume2\\Windows\\system32\\user32.dll"},
4646
kparams.FileType: {Name: kparams.FileType, Type: kparams.AnsiString, Value: "file"},
4747
kparams.FileOperation: {Name: kparams.FileOperation, Type: kparams.AnsiString, Value: "overwriteif"},
4848
kparams.BasePrio: {Name: kparams.BasePrio, Type: kparams.Int8, Value: int8(2)},
@@ -54,11 +54,11 @@ func TestTransform(t *testing.T) {
5454
Metadata: map[kevent.MetadataKey]any{"foo": "bar", "fooz": "barz"},
5555
}
5656

57-
transf, err := transformers.Load(transformers.Config{Type: transformers.Trim, Transformer: Config{Prefixes: []Trim{{Name: "file_name", Trim: "\\Device"}}, Suffixes: []Trim{{Name: "create_disposition", Trim: "if"}}}})
57+
transf, err := transformers.Load(transformers.Config{Type: transformers.Trim, Transformer: Config{Prefixes: []Trim{{Name: "file_path", Trim: "\\Device"}}, Suffixes: []Trim{{Name: "create_disposition", Trim: "if"}}}})
5858
require.NoError(t, err)
5959

6060
require.NoError(t, transf.Transform(kevt))
61-
filename, _ := kevt.Kparams.GetString(kparams.FileName)
61+
filename, _ := kevt.Kparams.GetString(kparams.FilePath)
6262
dispo, _ := kevt.Kparams.GetString(kparams.FileOperation)
6363

6464
assert.Equal(t, "\\HarddiskVolume2\\Windows\\system32\\user32.dll", filename)

‎pkg/kevent/queue_test.go‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,7 @@ func TestQueuePush(t *testing.T) {
7777
Category: ktypes.File,
7878
Kparams: Kparams{
7979
kparams.FileObject: {Name: kparams.FileObject, Type: kparams.Uint64, Value: uint64(12456738026482168384)},
80-
kparams.FileName: {Name: kparams.FileName, Type: kparams.UnicodeString, Value: "C:\\Windows\\system32\\user32.dll"},
80+
kparams.FilePath: {Name: kparams.FilePath, Type: kparams.UnicodeString, Value: "C:\\Windows\\system32\\user32.dll"},
8181
kparams.FileType: {Name: kparams.FileType, Type: kparams.AnsiString, Value: "file"},
8282
kparams.FileOperation: {Name: kparams.FileOperation, Type: kparams.Enum, Value: uint32(1), Enum: fs.FileCreateDispositions},
8383
},
@@ -104,7 +104,7 @@ func TestQueuePush(t *testing.T) {
104104
Category: ktypes.File,
105105
Kparams: Kparams{
106106
kparams.FileObject: {Name: kparams.FileObject, Type: kparams.Uint64, Value: uint64(12456738026482168384)},
107-
kparams.FileName: {Name: kparams.FileName, Type: kparams.UnicodeString, Value: "C:\\Windows\\system32\\user32.dll"},
107+
kparams.FilePath: {Name: kparams.FilePath, Type: kparams.UnicodeString, Value: "C:\\Windows\\system32\\user32.dll"},
108108
kparams.FileType: {Name: kparams.FileType, Type: kparams.AnsiString, Value: "file"},
109109
kparams.FileOperation: {Name: kparams.FileOperation, Type: kparams.Enum, Value: uint32(1), Enum: fs.FileCreateDispositions},
110110
},
@@ -131,7 +131,7 @@ func TestQueuePush(t *testing.T) {
131131
Category: ktypes.File,
132132
Kparams: Kparams{
133133
kparams.FileObject: {Name: kparams.FileObject, Type: kparams.Uint64, Value: uint64(12456738026482168384)},
134-
kparams.FileName: {Name: kparams.FileName, Type: kparams.UnicodeString, Value: "C:\\Windows\\system32\\user32.dll"},
134+
kparams.FilePath: {Name: kparams.FilePath, Type: kparams.UnicodeString, Value: "C:\\Windows\\system32\\user32.dll"},
135135
kparams.FileType: {Name: kparams.FileType, Type: kparams.AnsiString, Value: "file"},
136136
kparams.FileOperation: {Name: kparams.FileOperation, Type: kparams.Enum, Value: uint32(1), Enum: fs.FileCreateDispositions},
137137
},
@@ -159,7 +159,7 @@ func TestQueuePush(t *testing.T) {
159159
Category: ktypes.File,
160160
Kparams: Kparams{
161161
kparams.FileObject: {Name: kparams.FileObject, Type: kparams.Uint64, Value: uint64(12456738026482168384)},
162-
kparams.FileName: {Name: kparams.FileName, Type: kparams.UnicodeString, Value: "C:\\Windows\\system32\\user32.dll"},
162+
kparams.FilePath: {Name: kparams.FilePath, Type: kparams.UnicodeString, Value: "C:\\Windows\\system32\\user32.dll"},
163163
kparams.FileType: {Name: kparams.FileType, Type: kparams.AnsiString, Value: "file"},
164164
kparams.FileOperation: {Name: kparams.FileOperation, Type: kparams.Enum, Value: uint32(1), Enum: fs.FileCreateDispositions},
165165
},

‎pkg/yara/config/config_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -115,7 +115,7 @@ func TestAlertTitle(t *testing.T) {
115115
},
116116
{
117117
&kevent.Kevent{Type: ktypes.MapViewFile, Category: ktypes.File,
118-
Kparams: kevent.Kparams{kparams.FileName: {Name: kparams.FileName, Type: kparams.UnicodeString, Value: "C:\\Windows\\System32\\wusa.exe"}},
118+
Kparams: kevent.Kparams{kparams.FilePath: {Name: kparams.FilePath, Type: kparams.UnicodeString, Value: "C:\\Windows\\System32\\wusa.exe"}},
119119
},
120120
FileThreatAlertTitle,
121121
},

0 commit comments

Comments
 (0)