From 8bb6e851837f9d9cd2e5deaf6743654a3df7caf8 Mon Sep 17 00:00:00 2001 From: =?utf8?q?Eloy=20P=C3=A9rez=20Gonz=C3=A1lez?= Date: Fri, 22 Oct 2021 12:44:03 +0200 Subject: [PATCH] Adds test for krb5_msg_type keyword --- tests/krb5-krb5_msg_type/README.md | 3 ++ tests/krb5-krb5_msg_type/input.pcap | Bin 0 -> 14997 bytes tests/krb5-krb5_msg_type/test.rules | 5 ++++ tests/krb5-krb5_msg_type/test.yaml | 42 ++++++++++++++++++++++++++++ 4 files changed, 50 insertions(+) create mode 100644 tests/krb5-krb5_msg_type/README.md create mode 100644 tests/krb5-krb5_msg_type/input.pcap create mode 100644 tests/krb5-krb5_msg_type/test.rules create mode 100644 tests/krb5-krb5_msg_type/test.yaml diff --git a/tests/krb5-krb5_msg_type/README.md b/tests/krb5-krb5_msg_type/README.md new file mode 100644 index 000000000..7ceaa054b --- /dev/null +++ b/tests/krb5-krb5_msg_type/README.md @@ -0,0 +1,3 @@ +# PCAP + +The pcap included contains kerberos traffic generated from a Windows server 2019 with the klist tool. diff --git a/tests/krb5-krb5_msg_type/input.pcap b/tests/krb5-krb5_msg_type/input.pcap new file mode 100644 index 0000000000000000000000000000000000000000..7b04515521b81f7e7d5990940f2f6185b785b8d7 GIT binary patch literal 14997 zc-rln2Q*x5yZ2|t5WV+Kv}l0#>A@30VohKAp}eYfgHO+z+MnAIq>dLE)9$d zMuE5yaVjAcUsDx!iTUj|M4mz;e|vs8>$rnFh&-)!oaCv= z!@C~lU4yt0Dk53587HywT!QiQ@W2FluJFNhGEpHY7>oE>z@I5{e@RB(ze`4e3DgK? z0K1An6Q%J%d0;RYIpPY!R01lzzs@^JG~$r}iGZP{KoQ9}{nZPGfw&lw27!W3-{SxE z77y_jk&Bu&q%*JgtT{8t6QeF_1FTe{A2UyP9g1wdADyfS?O!u0Y6FmX5%ZUt;gsTz zoN|0Z(K?et3<3#XI;CW&Kf0#wJJ*SiNmu>jV(#aZiJN1z`G1+m^+5n~2(--UzOVQ?_Z zPb=OOW(<=%ojg)dNtpP_yh{^;3QX5V6 zNjbq6>2e@RWo z8Oh6pLn)2nP*NBiN_cvUUoJ`eciBvbqm07fC_|?aoXiC{N;?#e(vnjq7MD5`ci6}d z4zMkKb3L_8K>7ot%@l6*w6=$cX~EYK2b((jy#s7C@y8`FtR?*PKwCM~q2}5b@Awh0j+pYC%htR+%FDF)>f-Zahu&K; z8jF+UV}h3<{M?T*joj{9-!g~$V{x0?FBFnhEPT#SjHtOVu5;lcve@&8g&E*ebU9mfxRpz~C%xxVW0`!AAwKMW zpH}3{7`yVy@`hw6HARD_vfE3Zq@M}C8dMQ53s zMKley8rEn#7gW@~eo^UqVgK;F$qu;~%RJdqSyrUw>f)DWLlN_EMSq(2l#I(aF^!JI zH{vkDO-%CR3v8M{vnxlr$8icZ#$B265T(LbzfdsHpLKpNe82UZlS@;q*fmy>~LvsREd_)A5()P5mvS3Km^D z%e#*-XmHfotQqA_e;ycuaTQb;7TONrTeA90ZiR$JOINcMv zAZD+-ttE;Hr_qYI@o=GUTOJWMT4LOHWaQdcYfQG&jC+xm{VD!^;?l4)d+QPonk9A2 z@p6(*3h!NZS9$OUgqHkhY3LOA~)NpEad6T&oe!Un86xY5|EP^mo2*?_xXMG-K5=hxq2P*%-Dts z(+J^Dfm$8zwW;RW%#$>YA;PP=!sypAMI!LZ&%wJJ9JLO~XR#jgL|Tuv)eWlg=rbtE zcL#XN#)QdfMJW_AgN@lR6kC5(egmL-8=Tb%C}}`WIsuMfD?b(6N#zF=x1AjX%1@^% zU-*1)cXW8i?a)=1GIFv(DiMd|{tFk`9ajR(h?xd%JpA$uQN-Qaz9Q`s2F}v=;zZz% zN&PjCNGJq zPUHGF6zB;>^-K!TGkTAoQY^nA?eI`fDA#|YbV3Wm(18)6BRahH3xAHz;TzJd51*MY zbbyNS^Rx2-C^Eo#h~xLHqg@sFfP@0fHxf@o{?YKP;b>SeING^?b$Hn6aOeTh80-MY zIO0=q8XVdWg+t%jz@cw}58M9Ll;EZzIyA&9{hx;7pN8U}hT@-w;>?C3!#fJ*9e!#Q zy#t`$eybVsl3f=+br5cE)FyI_ZgtYIkJ=R-Y@XZqUP@}inQ!Y#&DCeqyJfL{w-NFol{t26*ub}dn8Cmei?(* zO)|umlhe{RAXWulv7>!RV}vIm!NO6qf}@}q&5XJQRlq%vapo1aNcyOW5Ek(rq_T;2 zB6!Nb2_A-($N&{Wo~B7oqw&B*UkYgVK@|4wfA zp7cTAN66*Az<3N-_xoxKy?k!c*R*~0g!bAm-WApn^VUrLwqmg9I_L5&v)}ugmtt<} z;Ehxjcw;V+RKQc4${6M!^#cgu7sUnRCrHD-|(p@~+KJiIctNuwXhCQEyba!HXE?i8;2AZEsc zm=dCzT%pHY5Zj&9;%*ggKa|$vT4dDYjp0HPd{oKqkgTVc@V?lyOy#fR-C6G@VIon21N z8v1h;WAX06M_t1ZnoJkI6$r7xvlk<}Q(wc!FwQp~riHn=t!NW-&!QBi4C%0i1@m38 zZ(>pTLJs}7;6T{jGc|?+=7lKV^HGsSJ^jL7Stq#HZxRpvP_mm2b~EYxRdZ9II^kvcOI&1Cfz7cOIDl00Q%bGEpWwc};Z0bmJ+tHBgyXTvwksY#C$=2As+{$OxUG@z;v4&79h#K<>WeJ7 z4L5sU>m*3k&Kr|_S!exZn7<}ZP}`R8S^nnT{=m?el&!(`g6CyYa4O#k=|Z-$Dk9K0 zuG`mJ!a{n+P=N;wvLL+aIe>j*Pu-4R1)EM98UDaAPt*m_dwTo#w-nk#F%`dMcL2`Z(>odA6`zWos zuK7{GyQHI0bti@lkU2*5)G(V8E^2Ph2@6Kg- zbpnfYAH`+n@{h_N1XS;!vka5F2Kvbs%I>d~|7q<>HLsA&VT1iyfa#a!N4#x~tC0t&6hm?S}JR1X!C5K|>f>_>hO9A1!CMC za%P_|k_h2sb0j{tjM^e8%JPYOWQ+(ccOR+q8a>N14NyS~qX~a@UhT*!V@N1Jxn`XM zq%w%0bMWK8jp!{%%bBAr z`R^P&g6R1fjLbD-ox~;jQ(SLxI{0b;Y6`+NU+Djnm<Pi868&FX^9;~DeEP>V|Kpnfan1j@=KlrP zTq!tA_hu$h#Fx^d`DVO;W9bY3N#*|G0Z;nROevo71EbI`pGs<4(+Tb(-HUwU*&^N4 z(jPB$rR6`dAg9d zd(V2f4%=zkVd?U|P7pj8|Hvh=_k2bLf99I@VO3j(CG5_LIR=42kpKB6EW#w~QxyB1 zWs(u)dUhHNDgtg+be4-u(ZD`&k$u0(NUbx+tCN3n(&(I&YsY(VR6C$tTmLs*!*Wed&SX z#+vncFoTw*>81~MF8(tEh&4qR{!mqf8;hniHxJrcH)>P3WIo+9aHmfqmyZQMh`Ps& zrjMy-Tj)l(d98RVZ0g3gI`0vOS4?jS;TWWgZ&fK zQeM}Wjt`0SyV}20$ZEZ!$4B|RfmEs){<4_WGJBnPi9Xppab@)Lr%_!7^e;51-?bKB zujtA3$qL!&JIy$X5A1wFv!F?+=B#dp`!6PbUtFImB%T~h;-&S$3|Ra6=B^5#VN(gE z8Lhy@FZCShO}?(WH)EHRSHPw?G)#ThfqX=?0NWuACTMw57w-_e%d_-fr=3?keWj|(P(v^3N z)jX3Eme3eD+>-JpS=)I;5BI}_Bc___h)kl8Uo+qyY;=QR0jKqCkCiD6wC?rCb&?Zj&n3Z z^OOeU(r$N7E%6Z+8J-`%FFZ;Ce|??3^bJnQdNdZH(MlijGGUw)i7R%^JOO@ZCPmRh zqk=n<=7#i%BlPcMErr6v=+aAHGCCMCaPdZb=fnOuQ2**-zaWwvr^^RlnKKpMm$ho=55f-?`{!sL`ebJ4P& ztQrP$AL_E3NbRxI3Z}ormcx$QRjRkPv41bYu8nPL6z?_D5_@&^h5ZcE^tvmfU4yLU zu&okT{}rqUEglvm4qZB`F01=!)sk+Sh!NWhn-t`USc*(((5XdM_AmFl^fo z>s0b_3O}NNTs7u0l@K1;unwgnHHCL#WxY4(BjjmU)Ek}PCvge= z6jztX#z8hf?L!zPIRBr->vKr6{`t%p`v7Xr&qm1@pr``psh+jHC?zn3g!0$+B84>^ zjRXcqBly3%z4(t7|D(nKXz~BwTKtDm5^*1~507<~5}RKku*;Jix^MSNKwhB2W|2nQ zN2N)1CK3OR-*(wp)xElWPnM((j?x7|p5SVx7RAJ%5vfD+DeM)1#HFWue6&h+D4=iV!mzD}$h&S;GC>j~++OJj@bn(d_Jc zpQU#B@3t4=U?|Wyfc|cS@t0BtwQzK_qr$!fM^l#Faa|`}-6(Lkf zyX#v-& zoqR$6zhnt|1JFW=K7DOS#Ug_D_Xw#4v#x;uz|ra;l)=g6})-xuGDeOwz~+oYsUTKEtA^9Qh#~e&x)<| zE<_#t3-uCoK2|Y1!#Sxf9b8I97+nYM39rGfqnzr&)cm+ui%O1#p}ly;fyo4VgmSLj z9Ly$`{*M?{j5eFC!o<|F#Zb4l`K|@f#vH00)_HjrVh?c`?+ZrrilfkB_pNWt_>$b> zwaELl5JUaKJq+*| zv2RiM8fL-ay{B1MNk{@!vWu<3gbzVUQicM$w>9=U`(EKpjSU0)w= zy_;;p*6PyDPMpQSh9e>LV8Pjcp!pp9T_yUUy!5pN`(iYyG5T0h^Ep;3=X=Exm43Ew zNlErx+vX;|1rDJ$6);N#@}=`x#HNi>+-$##7xzHMI4Bwu)$S|S2Rgc-*sp`sJR~b@ zL7;*7SnMz+VSP2-St3u393%Fa;>9-q%nmz>@r*7r$D?DkySL+4j^h|#ObivZv9Bs+ zs55Izh1@|=$C;!IBXhNfr9`?k&D1^tFFT0v8B36^QY*c7d*GwfYc;kwP41gzN$f2j ziYArJ_~gityE}Gjjq-q!mf>O9h@Iu}5N+8dl1aZ?1+M7%`xBR^ocOk}jdwk$Mqh(e z4cEQRsJ1ByE)ZTUjsAdXy&86DhKA0JEUdbI4OeXg0xI<*Q_SY%zj=A$yjfjbgqQ#s zvEN+lVzHo#X;VhHX)n|2lQ}tp%tp@~a(i6T9W+V&X40(Sb|t?{ZYKO*^|kUC=DQai zX!iAGKC6bp`KNpjFFsYnuY0N{!GGs+@f%iyp~B;g;&;=*x~(?F z{Dw0a&l3D`9g2*1-`-4N#$8wuPDUS&qQuM$>`{*xA(>?lQQJ${tn1aU5JMxit1v6` zs1hp>4%fXMKP0vEM0IeFU|%N z$9%#N)|A!o5ZLOMFXj%tZ8qLx>R5WbwN-4)Ue0yB#z~a5wA`}9nDR3#{DF$QM^c}O zsj8N6_2KyfrGvWmK+WmR;}T`(625meg2&WQa#3>Z2M7L3&o?=8;s;9nl{jL|Fs`-$3mKBtPnj0FsRIc&M^EisN{e_CC<`Bjb6%{#d~Qm&d*jMP?1Ah z=DUiMIZXNJL!?O1T+?$md3RomInO}NYh8-T=u|T7i@j7FuY{!W2-;{id{MP@Ss9dS zcw#)<)5eCs=G7he5oEp|qTQ&jE4;=`HY=uHc*mvvCG_BRDKm_hBm}I6DlDt9L%P#CRWwk@6m{G}| zyRCY0at1D)QzTHb27R837IeKrEP#}#k4bitq^PsLV>LSyLgeu$4I5iQxGKacev3QIK=hYHY-!*fVV|uy@gp~QS?;1f) wnMFb&_{qI3Bb8R7KfbhzNKGa{T0_JVOL any any (msg:"AS-REQ"; krb5_msg_type:10; sid:10;) +alert krb5 any any -> any any (msg:"AS-REP"; krb5_msg_type:11; sid:11;) +alert krb5 any any -> any any (msg:"TGS-REQ"; krb5_msg_type:12; sid:12;) +alert krb5 any any -> any any (msg:"TGS-REP"; krb5_msg_type:13; sid:13;) +alert krb5 any any -> any any (msg:"KRB-ERROR"; krb5_msg_type:30; sid:30;) \ No newline at end of file diff --git a/tests/krb5-krb5_msg_type/test.yaml b/tests/krb5-krb5_msg_type/test.yaml new file mode 100644 index 000000000..3a90f3171 --- /dev/null +++ b/tests/krb5-krb5_msg_type/test.yaml @@ -0,0 +1,42 @@ +# *** Add configuration here *** +requires: + min-version: 7 + features: + - RUST + +args: +- -k none + +checks: +- filter: + count: 2 + match: + event_type: alert + alert.signature_id: 10 + +- filter: + count: 1 + match: + event_type: alert + alert.signature_id: 11 + +- filter: + count: 3 + match: + event_type: alert + alert.signature_id: 12 + +- filter: + count: 3 + match: + event_type: alert + alert.signature_id: 13 + +- filter: + count: 1 + match: + event_type: alert + alert.signature_id: 30 + + + -- 2.47.2