From: Philippe Antoine Date: Tue, 14 Apr 2020 11:46:02 +0000 (+0200) Subject: Adds smb overlap evasion test X-Git-Tag: suricata-6.0.4~143 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4ed6b48d7bc3b5d4a6ce53eb4d15b38dbce267b1;p=thirdparty%2Fsuricata-verify.git Adds smb overlap evasion test --- diff --git a/tests/smb-eicar-overlap/README.md b/tests/smb-eicar-overlap/README.md new file mode 100644 index 000000000..92f5dec21 --- /dev/null +++ b/tests/smb-eicar-overlap/README.md @@ -0,0 +1,18 @@ +# Description + +Test SMB EICAR file rule with file overlap evasion. + +# PCAP + +The pcap comes from running Linux client smbclient against a Windows 2019 Server (with a shared forlder public wihtout needed authentication) +Command is +`smbclient //192.168.1.3/public/ -U % -m NT1` +Than in the smbclient shell : +`put eicar` where eicar is the name of a file with the EICAR contents : +https://en.wikipedia.org/wiki/EICAR_test_file + +The proxy changes the Write request with : +- a first dummy write of one byte at offset 0 is done +- the second full write of EICAR at offset 0 is then done and does not trigger detection + +Now, an event is set for file overlaps. diff --git a/tests/smb-eicar-overlap/input.pcap b/tests/smb-eicar-overlap/input.pcap new file mode 100644 index 000000000..4df168e89 Binary files /dev/null and b/tests/smb-eicar-overlap/input.pcap differ diff --git a/tests/smb-eicar-overlap/test.rules b/tests/smb-eicar-overlap/test.rules new file mode 100644 index 000000000..62b2f06d5 --- /dev/null +++ b/tests/smb-eicar-overlap/test.rules @@ -0,0 +1,3 @@ +alert smb any any -> any any (msg:"EICAR file"; flow:established; file_data; content:"|58354f2150254041505b345c505a58353428505e2937434329377d2445494341522d5354414e444152442d414e544956495255532d544553542d46494c452124482b482a|"; sid:1; rev:1;) + +alert smb any any -> any any (msg:"SURICATA SMB file overlap"; app-layer-event:smb.file_overlap; classtype:protocol-command-decode; sid:2225006; rev:1;) diff --git a/tests/smb-eicar-overlap/test.yaml b/tests/smb-eicar-overlap/test.yaml new file mode 100644 index 000000000..79eddfbef --- /dev/null +++ b/tests/smb-eicar-overlap/test.yaml @@ -0,0 +1,14 @@ +requires: + features: + - HAVE_LIBJANSSON + +# disables checksum verification +args: +- -k none + +checks: + - filter: + count: 2 + match: + event_type: alert + alert.signature_id: 2225006