tests: add dcerpc/smb test

diff --git a/tests/dcerpc-smb-test-01/README.md b/tests/dcerpc-smb-test-01/README.md
new file mode 100644 (file)
index 0000000..1effb79
--- /dev/null
+++ b/tests/dcerpc-smb-test-01/README.md
@@ -0,0 +1,2 @@
+Pcap from:
+20171220_smb_psexec_add_user.pcap

diff --git a/tests/dcerpc-smb-test-01/input.pcap b/tests/dcerpc-smb-test-01/input.pcap
new file mode 100644 (file)
index 0000000..a1ec294
Binary files /dev/null and b/tests/dcerpc-smb-test-01/input.pcap differ

diff --git a/tests/dcerpc-smb-test-01/test.rules b/tests/dcerpc-smb-test-01/test.rules
new file mode 100644 (file)
index 0000000..0706f9b
--- /dev/null
+++ b/tests/dcerpc-smb-test-01/test.rules
@@ -0,0 +1,3 @@
+alert tcp any any -> any any (flow:to_server; dcerpc.iface:367abb81-9844-35f1-ad32-98f038001003; dcerpc.opnum:15; sid:1;)
+alert smb any any -> any any (flow:to_server; dcerpc.iface:367abb81-9844-35f1-ad32-98f038001003; dcerpc.opnum:15; sid:2;)
+alert dcerpc any any -> any any (flow:to_server; dcerpc.iface:367abb81-9844-35f1-ad32-98f038001003; dcerpc.opnum:15; sid:3;)

diff --git a/tests/dcerpc-smb-test-01/test.yaml b/tests/dcerpc-smb-test-01/test.yaml
new file mode 100644 (file)
index 0000000..e3e492c
--- /dev/null
+++ b/tests/dcerpc-smb-test-01/test.yaml
@@ -0,0 +1,16 @@
+checks:
+- filter:
+    count: 2
+    match:
+      event_type: alert
+      alert.signature_id: 1
+- filter:
+    count: 2
+    match:
+      event_type: alert
+      alert.signature_id: 2
+- filter:
+    count: 2
+    match:
+      event_type: alert
+      alert.signature_id: 3