From 1a72d55bf1188fb143adb009a16a84d466f2ce1b Mon Sep 17 00:00:00 2001 From: Jeff Lucovsky Date: Mon, 13 Jan 2025 08:49:50 -0500 Subject: [PATCH] test/entropy: Basic entropy keyword test This commit adds a basic test of the entropy keyword. --- tests/entropy/entropy-01/README.md | 1 + tests/entropy/entropy-01/input.pcap | Bin 0 -> 1397 bytes tests/entropy/entropy-01/test.rules | 12 +++++++ tests/entropy/entropy-01/test.yaml | 49 ++++++++++++++++++++++++++++ 4 files changed, 62 insertions(+) create mode 100644 tests/entropy/entropy-01/README.md create mode 100644 tests/entropy/entropy-01/input.pcap create mode 100644 tests/entropy/entropy-01/test.rules create mode 100644 tests/entropy/entropy-01/test.yaml diff --git a/tests/entropy/entropy-01/README.md b/tests/entropy/entropy-01/README.md new file mode 100644 index 000000000..c1924f917 --- /dev/null +++ b/tests/entropy/entropy-01/README.md @@ -0,0 +1 @@ +This test checks the entropy keyword with a comparison against HTTP file data. diff --git a/tests/entropy/entropy-01/input.pcap b/tests/entropy/entropy-01/input.pcap new file mode 100644 index 0000000000000000000000000000000000000000..c84b2df7002156fe463a8b3f2d3cfa87a414bbab GIT binary patch literal 1397 zcmaKs&u`O66vxMDmlg|4g%fa^!)jG%Ydb%hHfhpLlhU90VG@_Nr~D9i z*oDZin+JjPh`aDF4PJ3Ta1R6EX#Zh@X>03bn05yxzWj#RWHq@>A^;%}I`GR1rBN!7 zHV^Xn(>9@gTsh+F%oDOrBs4;8qeNeX1p(rxw&#r9%$9w|ddnF<66y!3ivj;Ur_1P| ztfz$aCrO@KD~s7+-cnZR_`a;847m3Ifbml@6tXo#6MnWt8J`K}Q8AOn=CmH3T(SzN z9J8#l>Y0wu3)LQXSe1;t$H*6)u1fSwExwo*deXkpDz zUtC*f!4pEDwuka~ZQZ6U>`OV?QSX)j*pVK(L=h&YIW~n#%c$gslW~MoTEVUjY&v&~ z6lsb?bi+iUz9=%XIOm6hUOUY8$rp=6`LDI)*ii)&$5=`0g{}cOr5I#emm9jAey7{- z6ybPG-Vw-mn+2;REoysGyS(_A-}&yl|VIe^Y_xPi(bCvlm3O%e1LpJp|x0 DdZ&`u literal 0 HcmV?d00001 diff --git a/tests/entropy/entropy-01/test.rules b/tests/entropy/entropy-01/test.rules new file mode 100644 index 000000000..308d9ca51 --- /dev/null +++ b/tests/entropy/entropy-01/test.rules @@ -0,0 +1,12 @@ +# The entropy value is 4.137370175000773 +alert http any any -> any any (msg:"entropy simple test"; file.data; entropy: value > 4; sid:1;) +alert http any any -> any any (msg:"entropy simple test"; file.data; entropy: value >= 4; sid:2;) +alert http any any -> any any (msg:"entropy simple test"; file.data; entropy: value >= 5; sid:3;) +alert http any any -> any any (msg:"entropy simple test"; file.data; entropy: value 4-5; sid:4;) +alert http any any -> any any (msg:"entropy simple test"; file.data; entropy: value !4-5; sid:5;) +alert http any any -> any any (msg:"entropy simple test"; file.data; entropy: value < 4; sid:6;) +alert http any any -> any any (msg:"entropy simple test"; file.data; entropy: value != 4; sid:7;) +alert http any any -> any any (msg:"entropy simple test"; file.data; entropy: value = 4; sid:8;) +# The entropy value is 4.150007324019584 +alert http any any -> any any (msg:"entropy simple test"; file.data; entropy: offset 10, value > 4.14; sid:10;) + diff --git a/tests/entropy/entropy-01/test.yaml b/tests/entropy/entropy-01/test.yaml new file mode 100644 index 000000000..5fcc51ca5 --- /dev/null +++ b/tests/entropy/entropy-01/test.yaml @@ -0,0 +1,49 @@ +requires: + min-version: 8 + +checks: + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 1 + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 2 + - filter: + count: 0 + match: + event_type: alert + alert.signature_id: 3 + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 4 + - filter: + count: 0 + match: + event_type: alert + alert.signature_id: 5 + - filter: + count: 0 + match: + event_type: alert + alert.signature_id: 6 + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 7 + - filter: + count: 0 + match: + event_type: alert + alert.signature_id: 8 + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 10