officecom/oc-sentinel
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 21 Wiki Activity

Refine Exchange IIS authentication detection
All checks were successful
OfficeCom Sentinel Client / validate-client (push) Successful in 25s
Details
OfficeCom Sentinel Client / build-client-windows (push) Successful in 52s
Details

Browse Source
This commit is contained in:
OfficeCom Codex
2026-08-05 09:16:46 +02:00
parent 705b543e5a
commit 7f4cd291e7
2 changed files with 128 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
tests/OCSentinelCli.Tests/ExchangeIisLogParserTests.cs
View File

@@ -39,4 +39,29 @@ public sealed class ExchangeIisLogParserTests
Assert.Equal(444, attack.DestinationPort);
Assert.Equal("user@example.test", attack.Username);
}
[Fact]
public void IgnoresNormalIisAuthenticationHandshake()
{
string[] lines =
[
"#Fields: date time cs-uri-stem cs-username c-ip s-port cs(User-Agent) sc-status sc-substatus",
"2026-08-02 04:15:00 /mapi/emsmdb/ - 198.51.100.8 443 Outlook 401 1",
"2026-08-02 04:15:01 /mapi/emsmdb/ user@example.test 198.51.100.8 443 Outlook 200 0"
];
Assert.Empty(ExchangeIisLogParser.ParseLines(lines, new DateTimeOffset(2026, 8, 2, 4, 0, 0, TimeSpan.Zero)));
}
[Fact]
public void IgnoresNonCredentialIis401Substatus()
{
string[] lines =
[
"#Fields: date time cs-uri-stem cs-username c-ip s-port sc-status sc-substatus",
"2026-08-02 04:15:00 /ews/Exchange.asmx - 198.51.100.8 443 401 0"
];
Assert.Empty(ExchangeIisLogParser.ParseLines(lines, new DateTimeOffset(2026, 8, 2, 4, 0, 0, TimeSpan.Zero)));
}
}