From 7064e6b7f415b149b78e59d46f51f4c89362e769 Mon Sep 17 00:00:00 2001 From: DEL VALLE Bastien Date: Tue, 3 Mar 2020 18:35:29 +0100 Subject: [PATCH] Adds test for SMB EICAR file by segmentation in random bytes --- .../README.md | 15 +++++++++++++++ .../input.pcap | Bin 0 -> 22507 bytes .../test.rules | 1 + .../test.yaml | 14 ++++++++++++++ 4 files changed, 30 insertions(+) create mode 100644 tests/smb-eicar-file-segmentation-random/README.md create mode 100644 tests/smb-eicar-file-segmentation-random/input.pcap create mode 100644 tests/smb-eicar-file-segmentation-random/test.rules create mode 100644 tests/smb-eicar-file-segmentation-random/test.yaml diff --git a/tests/smb-eicar-file-segmentation-random/README.md b/tests/smb-eicar-file-segmentation-random/README.md new file mode 100644 index 000000000..963076f28 --- /dev/null +++ b/tests/smb-eicar-file-segmentation-random/README.md @@ -0,0 +1,15 @@ +# Description + +Test SMB EICAR file rule. + +# PCAP + +The pcap comes from running Linux client smbclient against a Windows 2019 Server (with a shared folder public without needed authentication) + +Needs a Proxy that can cut and send the request in random bytes length pieces + +Command is +`smbclient //localhost/public/ -U % -m NT1` +Than in the smbclient shell : +`put eicar` where eicar is the name of a file with the EICAR contents : +https://en.wikipedia.org/wiki/EICAR_test_file diff --git a/tests/smb-eicar-file-segmentation-random/input.pcap b/tests/smb-eicar-file-segmentation-random/input.pcap new file mode 100644 index 0000000000000000000000000000000000000000..ba4f9c5457a6abfba665e411eea925ce3c5306ac GIT binary patch literal 22507 zc-qaJd0dp$+s4lf+qfa91f?mK8mJ&3iYv0I-~tG^<&vOf{ywjoTDGdVluMSs7E{a2 z8JBF+aNjku!mZp$Wl_P@(o$T|%5vUwu7St%oH^b7@&5DT2OSl@T-SB(bD#5UbK>ju zb}RE__dh(Dh5x?#M#AuQ0luske=R;)#DYB|JXu7m(;fQQSa-&{*w@6dIPZX=d)HV- z@lTKK_bj`L8_gLjzIeHHqTkGmj9ERsHhNlZHCsNr{G#}Gi-(7gAfJBNmnHDOCx9%N zEy3sC-x zBJG8bez`qJa9%T zoc9gRkBoKC8kiz+ojIhljud8J4^p;5T4s<=GM3RhI6Xt4rgBtQPU)&cwXtsi zYPf=0VW3Vkmew;PzHe}(fIahyjdkIiF1q;`l2;q^v6eC)y9t-+e!&gOf0E1U4bIBq zud{T*de}EYSPw;4Ys+=1>PY)YRngDRMX==kVzivide_r&p0&eQm=9 zr}k8``nG7BNr_y2JkCCXG-)bXGFw3!tdP#hB@>_8H$F8Ivg%H=v2L8xO$Up#Zv$+A z0=s0uie0k$MutZX61b+*$mD&Id<{+VMM!?7ocw#!$i}uE(lQlk6>?*Xh=^j=q_oW7 zKJfy0mljtS;%pjm=OAvGERN-pEno-44N}D2m0N%qgD8P|J(nEMoj~I!Y-mcDLHhHDKW}$`bA90NdD&n08RR_L3t4H3tN?i) zSyQuko${&>xJxt0O~O~e^;K|<MN+6-U44Ti1gOp|(%U{=&zaj=_J*!H zWEQz-e4|^~=7!0OMkHE8BZ?ncd16tr;D7!)Z^`Yob58#nWrdb~PQJkVU+8*fZO7rg7X>ZI zEWXpe?uZa??^fOxFE8uz#u1H{KNJzG}wp4^FU{~KJw?GE~>!rXt z7%;vCnp7og={scM1Yxk9%3$XUnkbyIeRAPA-XRy1gIbGS3{@wkL%V0+CDS?tRCfgx zZ%)h5)n%cL#q!s&I#`7LFkp!aEZKk+RkKbt#b##(SzF&j zS&E`8-L1CnEhL-v54t0ax%~`GAts;zEqIR{!6VwFvg8r0?X1$&aS=I!M}dk{P=n8v$ucWod1ekd=BuTNxAO zN`<6ZOUOzs)KMs!*3iw)E++F@fj{6ph#G911pJAC^CvICxit`3T>T)6|* zu3B8tPnVL)nn2m_8fCdq_KK`5c`4a(PD5EIMcEv=;~2|*@P}k=6=}nNL#{1HOHTos z`yp8m#Q=3wK>wBNAtW^mJM%jql1T+4sXLma-au00<)p03$Qf9owfC+(197Hk!ZLD0 zU8*&=(7^BwbtaA;57TnaXgP~yIXJVK_z{^fB?;3PKtUI zqHbwKErFcD<0yKIhnRg51eO;6H zM&zAr+L)~*>+=_gYN?3YF4t#&Hja(KW@8l@(`Bu{J#I0LTSboA6<}H^n7#6-y#UUZ zRb)z!A*BjUO52fAf}GM0TGOxEl=9sxsl{rtulxqiV+v=V+*dN0>%8PEt4VhuaCc4P zZZF(*k=;#OO%~==t*QdKFvqeS0lK}KET(G!HB&$bP0cR5O4EvuNq?d6cU9xB0REz7 ze@SadR!gvc)3AT{{Q)OAM=Cu;6eJ!-Cpy2v*aSF+jFV1#MdVsOL zZl{n=HD!Jl=ILbl{0G#vEV9^VSZYPgu=p(ZsA;j-Ys+VX9Mi9RPQS`GWPLL;)0vfj zcVqrb)M&trc{zbG`@a6->U!e@*kb-mob0Q~Ms^piWFSjnsVt23<^S4&C9rn<&lDEH zda!ubhtnD}`YSB|`W2r4`V}7k`V~IR#;Q-82^Ry|7~XG2vGMGAHi-rE`S2v0$R^|W zU>3!{FOt`>`1fadEs3wp=KnK_|4SrqOfjrIYx{qqv}fTUh+24YE!prYwDaaj(S(RO zyxc2|hUc-4T=K31(^SD6H85E64)BT+tpBVd*Yz7qV3mtpN(tyzl=Wa9V0deF?8=jE38qzz;-Ie`gOFy3-8xi|+m zkby@a@JpJ&?;`Nda^OccP*vbyx|rtKOjVGzSAaTiq(;tR0jRzLs%7d;xeFla<&C7h zNZ7mRZf~9!>_y7hi2(qUSRL6|jk_OoyjdQ=nX#xWi)ZCNieBi0LOyOmz{{W2Q5lo2bkD4lhWmp-2ic zB$e=ja%~VjT)cu!WbEGH)m3rO=Zu}ovJH7wSWEq=a*v{(z0JQPVWvc)QYRpWSm3ptLpwPhb~9!DE) z^xaCDjDg8>8j~?FX}aE;wUsnk2cj&Bs3g-k+ThdAwXa&Zm0H0ZzTnvuUaDyY8-ZJa zXpbG>@vO#UlJI!urtI;Ttz>Q0)oMz2tF6}CNNaw;cq^EG?u+v(n&YpXI+-#jV4mQ7 zyp4>gBO*GZi6|8j{US%?v7PKz^`ObBXzFk3RynSVef_tSsyabcsYX>lsJdu6HL;zX zG4-{o25UOsJ2a?)w#tW^L3MFHXggU-0a`^*$fZ2|muurLe2PQ%hjvoO z|BfJ_{!mb(<>UV}$GR3F*!0kc99-q;qkP_<7jw1 zB71y!7dibJX~*zodHM|;`=$Ubp+$9rs8bqI;~}a*7PWjASql$C)Srr|sd6n`5SYl_ zq@*}VI;oNLG9>MkB}H>q5`UeflhoeP7?OTfBuz6Uonvh6s+gm*5^Xo`U&DBAH)*p8 zn7=E`H{2G#LfU3LZ2qXRISn?q$~H@BNx_hGN0IcVED04_Zx2~jO|>&;fo64>y@y=< z9s%fv0(x6s{Hm{El-lHH@D5Uq~zBiWTux!lZy=34C2)s}e_yPoOx>w0}FBy0< z$hxV>`oOIQrqYrUA?buh(%X=<%5)lMFWIJ=L(+9c(o*-$RNz;nrX*-OuF9S_ak_(2nx5q6v}7e3b7Qg;)Ckxkf$)%q0c$k%7U%<{**f zb5*C=4p7h7I6}a?pzuC1c%{`3HX5V7^Z@BI6u_$raHE^gz=LD~_C(PfF&9l_vd|_9 zu=IPm0E0Lyg}+YGN$Tuq2}#9@q)mpT3soqmQ&gIVs5Is};oa*X*>+n2d|3e(7~uOi zuzo?iO@`YaG;TM+ZNBU_kFyf_>qMQXc8=B%byg8|&=AFsiNhEh%6~=j+KzD@uG2ol zfc#lOo|1irGn~vzK1BLVfzR(XJ`cjD>4w;pL-;Oyx`~Q$glk8&*br65po)J+aeG}*se61K?ZGNiSl$M!=>GbHr!tR`lO+bUQwq)3 zpcPBwBXFt5$Z|?W3G7!&V4g6Ga%v}+Q~zV+*17|vl_=5z4QYI9ZL7M5JmVNy5FJ4} zqmUZP1%dOESLm!d0aK`88p&CCvLHMZP&O;ol&mVuLNlBq4xZ&%#d(G`n_KzPzaPDccgC}YGTMidpXxxitq$=W)XRkqbI08DAXASRh;C& zqLo)fPPb%m4lA5l2B%O=T`X5V#pDu`0?;=KXtn_=5jQJ|YN#I48pUKi4?qomrPN@h zhz|8UST2uF#pG6@7qlHvw7q3$lWtvGL8}@FReLq6W8Vf7>d9aC)T!#|=nYjn z6;%rjRp+Z&Nv_Prci|@WVsbt01MGJScC~@!>*=6&X-)A|PC^Okb`ad|(YSpJZabOo zD=wkln#R!=vbHI*J~L$f#8~sV`1B#sL(?B0)Gj(CeRyaL-puH^5^^G>YTNuSc_Ji+ z;tqJ)>tJ}@t?~L9yavl&x0R3=meRCSevhH)G;cOjnsrY}biK(+2{}X4wG-=Gd4^_$ z;V2`klyvww9PZLM+yjTTWrqVe>;4;+DWaks{UBI`F9@u^Ai8A)OBsaYv_ z)0R@QY%@UoN+A}?Wji1xqd$!PN*f&lqdPT5_rs`ZYjd-d?B1D>wMmgxBzNzytnQgv zVLej%bZ^=$xm9vYJlB4PR5%n0cW4xfclGfvzAh_t(yU=%ZP&0agH}PFEybs72 z9cxJ5aIjv}viQOu<=S1gF;+nB!tcerovaP-T27}_Pv^)5JPR>@t;Bq}XhKwoX#rn( zjx3`7!0c8qR}2h}$wOVoQCx!beFb@FJrbnP6;eBcRP4G2>SNq1 zcAZS?Nu;%2lU69wN|DpLMYEm)D^J6U1*=bG59XV86<|`}1_dKh9Gl zgrJ+$yC^wEX@@zM|G>%V{yfvFcTu`>i?shVB(GB>Pv)d any any (msg:"EICAR file"; flow:established; file_data; content:"|58354f2150254041505b345c505a58353428505e2937434329377d2445494341522d5354414e444152442d414e544956495255532d544553542d46494c452124482b482a|"; sid:1; rev:1;) diff --git a/tests/smb-eicar-file-segmentation-random/test.yaml b/tests/smb-eicar-file-segmentation-random/test.yaml new file mode 100644 index 000000000..c1282b105 --- /dev/null +++ b/tests/smb-eicar-file-segmentation-random/test.yaml @@ -0,0 +1,14 @@ +requires: + features: + - HAVE_LIBJANSSON + +# disables checksum verification +args: +- -k none + +checks: + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 1 -- 2.47.2