59 lines
1.8 KiB
C#
59 lines
1.8 KiB
C#
using OCSentinelCli;
|
|
using Xunit;
|
|
|
|
namespace OCSentinelCli.Tests;
|
|
|
|
public sealed class ExchangeIisAccountCorrelatorTests
|
|
{
|
|
[Fact]
|
|
public void EnrichesAnIisFailureFromOneMatchingSecurityFailure()
|
|
{
|
|
DateTimeOffset timestamp = new(2026, 8, 5, 4, 0, 0, TimeSpan.Zero);
|
|
List<AttackEvent> events =
|
|
[
|
|
IisFailure(timestamp),
|
|
SecurityFailure(timestamp.AddSeconds(20), "user@example.test")
|
|
];
|
|
|
|
AttackEvent enriched = Assert.Single(ExchangeIisAccountCorrelator.Enrich(events), attack => attack.Source == "IIS W3C");
|
|
|
|
Assert.Equal("user@example.test", enriched.Username);
|
|
}
|
|
|
|
[Fact]
|
|
public void KeepsIisAccountUnresolvedWhenMultipleAccountsMatch()
|
|
{
|
|
DateTimeOffset timestamp = new(2026, 8, 5, 4, 0, 0, TimeSpan.Zero);
|
|
List<AttackEvent> events =
|
|
[
|
|
IisFailure(timestamp),
|
|
SecurityFailure(timestamp.AddSeconds(20), "first@example.test"),
|
|
SecurityFailure(timestamp.AddSeconds(30), "second@example.test")
|
|
];
|
|
|
|
AttackEvent unresolved = Assert.Single(ExchangeIisAccountCorrelator.Enrich(events), attack => attack.Source == "IIS W3C");
|
|
|
|
Assert.Equal("[not logged]", unresolved.Username);
|
|
}
|
|
|
|
private static AttackEvent IisFailure(DateTimeOffset timestamp) => new()
|
|
{
|
|
Timestamp = timestamp,
|
|
SourceIp = "198.51.100.8",
|
|
Username = "[not logged]",
|
|
Source = "IIS W3C",
|
|
Target = "Exchange ActiveSync login"
|
|
};
|
|
|
|
private static AttackEvent SecurityFailure(DateTimeOffset timestamp, string username) => new()
|
|
{
|
|
Timestamp = timestamp,
|
|
SourceIp = "198.51.100.8",
|
|
Username = username,
|
|
Source = "Security",
|
|
Service = "Network",
|
|
Target = "Windows login",
|
|
InstanceId = 4625
|
|
};
|
|
}
|