Merge pull request #8045 from Security-Onion-Solutions/fix/mhr_naming

Fix naming for Malware Hash Registry analyzer
This commit is contained in:
weslambert
2022-05-31 07:52:48 -04:00
committed by GitHub
12 changed files with 14 additions and 14 deletions

View File

@@ -1,26 +1,26 @@
from io import StringIO from io import StringIO
import sys import sys
from unittest.mock import patch, MagicMock from unittest.mock import patch, MagicMock
from mhr import mhr from malwarehashregistry import malwarehashregistry
import unittest import unittest
class TestMHRMethods(unittest.TestCase): class TestMalwareHashRegistryMethods(unittest.TestCase):
def test_main_missing_input(self): def test_main_missing_input(self):
with patch('sys.exit', new=MagicMock()) as sysmock: with patch('sys.exit', new=MagicMock()) as sysmock:
with patch('sys.stderr', new=StringIO()) as mock_stderr: with patch('sys.stderr', new=StringIO()) as mock_stderr:
sys.argv = ["cmd"] sys.argv = ["cmd"]
mhr.main() malwarehashregistry.main()
self.assertEqual(mock_stderr.getvalue(), "usage: cmd [-h] artifact\ncmd: error: the following arguments are required: artifact\n") self.assertEqual(mock_stderr.getvalue(), "usage: cmd [-h] artifact\ncmd: error: the following arguments are required: artifact\n")
sysmock.assert_called_once_with(2) sysmock.assert_called_once_with(2)
def test_main_success(self): def test_main_success(self):
output = {"foo": "bar"} output = {"foo": "bar"}
with patch('sys.stdout', new=StringIO()) as mock_stdout: with patch('sys.stdout', new=StringIO()) as mock_stdout:
with patch('mhr.mhr.analyze', new=MagicMock(return_value=output)) as mock: with patch('malwarehashregistry.malwarehashregistry.analyze', new=MagicMock(return_value=output)) as mock:
sys.argv = ["cmd", "input"] sys.argv = ["cmd", "input"]
mhr.main() malwarehashregistry.main()
expected = '{"foo": "bar"}\n' expected = '{"foo": "bar"}\n'
self.assertEqual(mock_stdout.getvalue(), expected) self.assertEqual(mock_stdout.getvalue(), expected)
mock.assert_called_once() mock.assert_called_once()
@@ -32,7 +32,7 @@ class TestMHRMethods(unittest.TestCase):
flags = 0 flags = 0
options = {"whoishost": server} options = {"whoishost": server}
with patch('whois.NICClient.whois_lookup', new=MagicMock(return_value=output)) as mock: with patch('whois.NICClient.whois_lookup', new=MagicMock(return_value=output)) as mock:
response = mhr.sendReq(hash) response = malwarehashregistry.sendReq(hash)
mock.assert_called_once_with(options, hash, flags) mock.assert_called_once_with(options, hash, flags)
self.assertIsNotNone(response) self.assertIsNotNone(response)
self.assertEqual(response, {"hash": "84af04b8e69682782607a0c5796ca56999eda6b3", "last_seen": "2019-15-07 03:30:33", "av_detection_percentage": 35}) self.assertEqual(response, {"hash": "84af04b8e69682782607a0c5796ca56999eda6b3", "last_seen": "2019-15-07 03:30:33", "av_detection_percentage": 35})
@@ -44,42 +44,42 @@ class TestMHRMethods(unittest.TestCase):
flags = 0 flags = 0
options = {"whoishost": server} options = {"whoishost": server}
with patch('whois.NICClient.whois_lookup', new=MagicMock(return_value=output)) as mock: with patch('whois.NICClient.whois_lookup', new=MagicMock(return_value=output)) as mock:
response = mhr.sendReq(hash) response = malwarehashregistry.sendReq(hash)
mock.assert_called_once_with(options, hash, flags) mock.assert_called_once_with(options, hash, flags)
self.assertIsNotNone(response) self.assertIsNotNone(response)
self.assertEqual(response, {"hash": "84af04b8e69682782607a0c5796ca5696b3", "last_seen": "NO_DATA", "av_detection_percentage": 0}) self.assertEqual(response, {"hash": "84af04b8e69682782607a0c5796ca5696b3", "last_seen": "NO_DATA", "av_detection_percentage": 0})
def test_prepareResults_none(self): def test_prepareResults_none(self):
raw = {"hash": "14af04b8e69682782607a0c5796ca56999eda6b3", "last_seen": "NO_DATA", "av_detection_percentage": 0} raw = {"hash": "14af04b8e69682782607a0c5796ca56999eda6b3", "last_seen": "NO_DATA", "av_detection_percentage": 0}
results = mhr.prepareResults(raw) results = malwarehashregistry.prepareResults(raw)
self.assertEqual(results["response"], raw) self.assertEqual(results["response"], raw)
self.assertEqual(results["summary"], "no_results") self.assertEqual(results["summary"], "no_results")
self.assertEqual(results["status"], "ok") self.assertEqual(results["status"], "ok")
def test_prepareResults_harmless(self): def test_prepareResults_harmless(self):
raw = {"hash": "14af04b8e69682782607a0c5796ca56999eda6b3", "last_seen": "123456", "av_detection_percentage": 0} raw = {"hash": "14af04b8e69682782607a0c5796ca56999eda6b3", "last_seen": "123456", "av_detection_percentage": 0}
results = mhr.prepareResults(raw) results = malwarehashregistry.prepareResults(raw)
self.assertEqual(results["response"], raw) self.assertEqual(results["response"], raw)
self.assertEqual(results["summary"], "harmless") self.assertEqual(results["summary"], "harmless")
self.assertEqual(results["status"], "ok") self.assertEqual(results["status"], "ok")
def test_prepareResults_sus(self): def test_prepareResults_sus(self):
raw = {"hash": "14af04b8e69682782607a0c5796ca56999eda6b3", "last_seen": "123456", "av_detection_percentage": 1} raw = {"hash": "14af04b8e69682782607a0c5796ca56999eda6b3", "last_seen": "123456", "av_detection_percentage": 1}
results = mhr.prepareResults(raw) results = malwarehashregistry.prepareResults(raw)
self.assertEqual(results["response"], raw) self.assertEqual(results["response"], raw)
self.assertEqual(results["summary"], "suspicious") self.assertEqual(results["summary"], "suspicious")
self.assertEqual(results["status"], "caution") self.assertEqual(results["status"], "caution")
def test_prepareResults_mal(self): def test_prepareResults_mal(self):
raw = {"hash": "14af04b8e69682782607a0c5796ca56999eda6b3", "last_seen": "123456", "av_detection_percentage": 51} raw = {"hash": "14af04b8e69682782607a0c5796ca56999eda6b3", "last_seen": "123456", "av_detection_percentage": 51}
results = mhr.prepareResults(raw) results = malwarehashregistry.prepareResults(raw)
self.assertEqual(results["response"], raw) self.assertEqual(results["response"], raw)
self.assertEqual(results["summary"], "malicious") self.assertEqual(results["summary"], "malicious")
self.assertEqual(results["status"], "threat") self.assertEqual(results["status"], "threat")
def test_prepareResults_error(self): def test_prepareResults_error(self):
raw = {} raw = {}
results = mhr.prepareResults(raw) results = malwarehashregistry.prepareResults(raw)
self.assertEqual(results["response"], raw) self.assertEqual(results["response"], raw)
self.assertEqual(results["summary"], "internal_failure") self.assertEqual(results["summary"], "internal_failure")
self.assertEqual(results["status"], "caution") self.assertEqual(results["status"], "caution")
@@ -87,7 +87,7 @@ class TestMHRMethods(unittest.TestCase):
def test_analyze(self): def test_analyze(self):
output = {"hash": "14af04b8e69682782607a0c5796ca56999eda6b3", "last_seen": "NO_DATA", "av_detection_percentage": 0} output = {"hash": "14af04b8e69682782607a0c5796ca56999eda6b3", "last_seen": "NO_DATA", "av_detection_percentage": 0}
artifactInput = '{"value": "14af04b8e69682782607a0c5796ca56999eda6b3", "artifactType": "hash"}' artifactInput = '{"value": "14af04b8e69682782607a0c5796ca56999eda6b3", "artifactType": "hash"}'
with patch('mhr.mhr.sendReq', new=MagicMock(return_value=output)) as mock: with patch('malwarehashregistry.malwarehashregistry.sendReq', new=MagicMock(return_value=output)) as mock:
results = mhr.analyze(artifactInput) results = malwarehashregistry.analyze(artifactInput)
self.assertEqual(results["summary"], "no_results") self.assertEqual(results["summary"], "no_results")
mock.assert_called_once() mock.assert_called_once()