Beispiel #1
0
def test_malware_creation():
    """Tests the creation of a single malware."""
    mal = Malware(name='Gootkit')
    assert mal.id is None
    mal = mal.save()
    assert isinstance(mal, Malware)
    assert mal.id is not None
Beispiel #2
0
def populate_malware():
    m1 = Malware(name='Gootkit').save()
    m1.family = ['banker', 'trojan']
    m1.save()
    m2 = Malware(name='Sofacy').save()
    m2.family = ['trojan']
    m2.save()
    return [m1, m2]
Beispiel #3
0
def populate_malware():
    malware = []
    m1 = Malware(name='Gootkit', labels=['banker']).save()
    malware.append(m1)
    m2 = Malware(name='Sofacy', labels=['apt']).save()
    malware.append(m2)
    m3 = Malware(name='Zeus', labels=['trojan']).save()
    malware.append(m3)
    return malware
Beispiel #4
0
def clean_db():
    # pylint: disable=protected-access
    # We need to access the collections to make sure they are in the cache
    Entity._get_collection()
    Malware._get_collection()
    Observable._get_collection()
    Hostname._get_collection()
    Tag._get_collection()
    Vocabs._get_collection()
    db.clear()
def test_update_malware():
    """Tests that a Malware object is succesfully updated."""
    kc_phases = [{'kill_chain_name': 'cyber', 'phase_name': 'cyber1'}]
    malware = Malware(name='asd',
                      labels=['label1'],
                      description='123',
                      kill_chain_phases=kc_phases)
    malware.save()
    modified = malware.modified
    stix_id = malware.id
    updated = malware.update({'name': 'dsa'})
    assert updated.name == 'dsa'
    assert updated.description == '123'
    assert updated.kill_chain_phases == kc_phases
    assert malware.modified > modified
    assert updated.id == stix_id
def test_malware_import():
    """Tests the importing the result of MTIRE's TAXII information."""
    malware = Malware.from_stix_object(MITRE_MALWARE).save()
    # pylint: disable=protected-access
    assert malware._stix_object is not None
    assert isinstance(malware._stix_object, StixMalware)
    assert malware.type == 'malware'
    assert malware.id == 'malware--79499993-a8d6-45eb-b343-bf58dea5bdde'
    assert malware.created_by_ref == 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5'
    assert str(malware.created) == '2018-04-18 17:59:24.739000+00:00'
    assert str(malware.modified) == '2018-04-18 17:59:24.739000+00:00'
    assert malware.name == 'Briba'
    assert malware.description == 'Briba is a trojan used by Elderwood to open a backdoor and download files on to compromised hosts. (Citation: Symantec Elderwood Sept 2012) (Citation: Symantec Briba May 2012)\n\nAliases: Briba'
    assert malware.labels == ['malware']
    assert malware.external_references == [
        {
            'source_name': 'mitre-attack',
            'url': 'https://attack.mitre.org/wiki/Software/S0204',
            'external_id': 'S0204'
        },
        {
            'source_name': 'Symantec Elderwood Sept 2012',
            'description': 'O\'Gorman, G., and McDonald, G.. (2012, September 6). The Elderwood Project. Retrieved February 15, 2018.',
            'url': 'http://www.symantec.com/content/en/us/enterprise/media/security%20response/whitepapers/the-elderwood-project.pdf'
        },
        {
            'source_name': 'Symantec Briba May 2012',
            'description': 'Ladley, F. (2012, May 15). Backdoor.Briba. Retrieved February 21, 2018.',
            'url': 'https://www.symantec.com/security%20response/writeup.jsp?docid=2012-051515-2843-99'
        }
    ]
    assert malware.object_marking_refs == ['marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168']
    assert malware.get_extended_property('x_mitre_aliases') == ['Briba']
def test_filter_latest_versions():
    """Tests that filtering only returns latest versions."""
    malware1 = Malware(name='malware1', labels=['label1']).save()
    Malware(name='malware2', labels=['label1']).save()
    malware1.update({'name': 'malware11'})
    assert Malware.filter({'name':
                           'malware1'})[0].modified == malware1.modified
    assert len(Malware.filter({'name': 'malware'})) == 2
def test_malware_versionning():
    """Tests that a getting a Malware object returns the most recent version."""
    malware = Malware(name='asd', labels=['label1'])
    malware.save()
    stix_id = malware.id
    malware.update({'name': 'dsa'})
    fetched = Malware.get(stix_id)
    assert fetched.id == stix_id
    assert fetched.created < fetched.modified
Beispiel #9
0
def populate_malware_large():
    malware = []
    for i in range(100):
        malware.append(
            Malware(name=f'Malware{i:03}', labels=['trojan']).save())
    return malware
def test_malware_creation():
    """Tests the creation of a single Malware object."""
    malware = Malware(name='asd', labels=['label1'])
    # pylint: disable=protected-access
    assert malware._stix_object is not None
    assert isinstance(malware._stix_object, StixMalware)
def test_malformed_malware():
    """Tests that a Malware object missing fields cannot be created."""
    with pytest.raises(ValidationError):
        Malware(name='asd')
def test_save_malware():
    """Tests that a Malware object missing fields cannot be created."""
    malware = Malware(name='asd', labels=['label1'])
    saved = malware.save()
    assert saved is not None
Beispiel #13
0
def test_invalid_malware_family():
    """Tests that malware can't be created with invalid families."""
    with pytest.raises(ValidationError):
        Malware(name="123", family='asd').save()
Beispiel #14
0
def test_malware_fetch():
    """Tests creating a Malware object and saving it."""
    mal = Malware(name='Gootkit').save()
    fetched_mal = Malware.get(mal.id)
    assert isinstance(fetched_mal, Malware)
    assert fetched_mal.id == mal.id
Beispiel #15
0
def test_malware_attributes():
    """Tests that a created Malware has all needed attributes."""
    allitems = Malware.list()
    for malware in allitems:
        assert hasattr(malware, 'family')
        assert isinstance(malware.family, list)
def test_malware_delete():
    malware = Malware(name='asd', labels=['label1']).save()
    malware.update({'name': 'dsa'})
    assert len(Malware.list()) == 1
    malware.delete(all_versions=True)
    assert not Malware.list()
def test_all_versions():
    """Tests that a updating malware results in two versions."""
    malware = Malware(name='asd', labels=['label1']).save()
    malware.update({'name': 'dsa'})
    assert len(malware.all_versions()) == 2