From fdb4685f842df9435bb8f693c3be1070b80707fb Mon Sep 17 00:00:00 2001 From: Alice Akaki Date: Fri, 31 Jan 2025 08:48:47 -0400 Subject: [PATCH 1/2] detect: add test for ldap.request.dn keyword Ticket: #7471 --- tests/detect-ldap-dn/README.md | 5 +++++ tests/detect-ldap-dn/test.rules | 1 + tests/detect-ldap-dn/test.yaml | 17 +++++++++++++++++ 3 files changed, 23 insertions(+) create mode 100644 tests/detect-ldap-dn/README.md create mode 100644 tests/detect-ldap-dn/test.rules create mode 100644 tests/detect-ldap-dn/test.yaml diff --git a/tests/detect-ldap-dn/README.md b/tests/detect-ldap-dn/README.md new file mode 100644 index 000000000..127a77ed6 --- /dev/null +++ b/tests/detect-ldap-dn/README.md @@ -0,0 +1,5 @@ +Test ldap.request.dn keyword. + +PCAP from ../ldap-search/ldap.pcap + +Redmine ticket: https://redmine.openinfosecfoundation.org/issues/7471 \ No newline at end of file diff --git a/tests/detect-ldap-dn/test.rules b/tests/detect-ldap-dn/test.rules new file mode 100644 index 000000000..5554354fd --- /dev/null +++ b/tests/detect-ldap-dn/test.rules @@ -0,0 +1 @@ +alert ldap any any -> any any (msg:"Test ldap request dn"; ldap.request.dn; content:"dc=example,dc=com"; startswith; endswith; sid:1;) diff --git a/tests/detect-ldap-dn/test.yaml b/tests/detect-ldap-dn/test.yaml new file mode 100644 index 000000000..c649f474b --- /dev/null +++ b/tests/detect-ldap-dn/test.yaml @@ -0,0 +1,17 @@ +requires: + min-version: 8 + +pcap: ../ldap-search/ldap.pcap + +args: + - -k none --set stream.inline=true + +checks: + - filter: + count: 1 + match: + event_type: alert + pcap_cnt: 4 + ldap.request.operation: search_request + ldap.request.search_request.base_object: dc=example,dc=com + alert.signature_id: 1 From 800d87875c90b0b8e0fcb593f94d22a44cddc9e3 Mon Sep 17 00:00:00 2001 From: Alice Akaki Date: Wed, 5 Feb 2025 21:54:44 -0400 Subject: [PATCH 2/2] detect: add test for ldap.responses.dn keyword Ticket: #7471 --- tests/detect-ldap-dn/README.md | 3 ++- tests/detect-ldap-dn/test.rules | 1 + tests/detect-ldap-dn/test.yaml | 8 ++++++++ 3 files changed, 11 insertions(+), 1 deletion(-) diff --git a/tests/detect-ldap-dn/README.md b/tests/detect-ldap-dn/README.md index 127a77ed6..a9e176324 100644 --- a/tests/detect-ldap-dn/README.md +++ b/tests/detect-ldap-dn/README.md @@ -1,4 +1,5 @@ -Test ldap.request.dn keyword. +Test ldap.request.dn and +ldap.responses.dn keywords. PCAP from ../ldap-search/ldap.pcap diff --git a/tests/detect-ldap-dn/test.rules b/tests/detect-ldap-dn/test.rules index 5554354fd..056c5b58a 100644 --- a/tests/detect-ldap-dn/test.rules +++ b/tests/detect-ldap-dn/test.rules @@ -1 +1,2 @@ alert ldap any any -> any any (msg:"Test ldap request dn"; ldap.request.dn; content:"dc=example,dc=com"; startswith; endswith; sid:1;) +alert ldap any any -> any any (msg:"Test ldap responses dn"; ldap.responses.dn; content:"dc=example,dc=com"; startswith; endswith; sid:2;) \ No newline at end of file diff --git a/tests/detect-ldap-dn/test.yaml b/tests/detect-ldap-dn/test.yaml index c649f474b..8bddd264a 100644 --- a/tests/detect-ldap-dn/test.yaml +++ b/tests/detect-ldap-dn/test.yaml @@ -15,3 +15,11 @@ checks: ldap.request.operation: search_request ldap.request.search_request.base_object: dc=example,dc=com alert.signature_id: 1 + - filter: + count: 1 + match: + event_type: alert + pcap_cnt: 6 + ldap.responses[0].operation: search_result_entry + ldap.responses[0].search_result_entry.base_object: dc=example,dc=com + alert.signature_id: 2