88 lines
2.8 KiB
C#
88 lines
2.8 KiB
C#
using System.Runtime.Versioning;
|
|
using System.Text.Json;
|
|
using Xunit;
|
|
|
|
namespace OCSentinelCli.Tests;
|
|
|
|
[SupportedOSPlatform("windows")]
|
|
public sealed class RansomwareBetaTests
|
|
{
|
|
[Fact]
|
|
public void RansomwareBetaIsEnabledByDefault()
|
|
{
|
|
Assert.True(new ScannerConfiguration().RansomwareBetaEnabled);
|
|
Assert.False(new ScannerConfiguration().RansomwareBetaAlertingEnabled);
|
|
}
|
|
|
|
[Fact]
|
|
public void DisabledRansomwareBetaDoesNotReportSensorCoverage()
|
|
{
|
|
var summary = RansomwareBetaDetector.Scan(new ScannerConfiguration { RansomwareBetaEnabled = false }, []);
|
|
|
|
Assert.False(summary.Enabled);
|
|
Assert.Empty(summary.Sensors);
|
|
}
|
|
|
|
[Fact]
|
|
public void SensorCoverageIsIncludedInTheJsonReport()
|
|
{
|
|
var summary = new RansomwareBetaSummary
|
|
{
|
|
Enabled = true,
|
|
Sensors = [new RansomwareSensorStatus { Name = "security-process-4688", Enabled = true, Available = true, State = "available", EventCount = 4 }]
|
|
};
|
|
|
|
string json = JsonSerializer.Serialize(summary, JsonOptions.Default);
|
|
|
|
Assert.Contains("\"Sensors\"", json);
|
|
Assert.Contains("security-process-4688", json);
|
|
}
|
|
|
|
[Fact]
|
|
public void FileChurnBelowBothThresholdsDoesNotCreateSignal()
|
|
{
|
|
var summary = new RansomwareFileChurnSummary
|
|
{
|
|
Enabled = true,
|
|
DataAvailable = true,
|
|
DeleteOperationCount = 49,
|
|
WriteOperationCount = 500
|
|
};
|
|
|
|
RansomwareSignal? signal = RansomwareFileChurnDetector.CreateSignal(summary, new ScannerConfiguration());
|
|
|
|
Assert.Null(signal);
|
|
}
|
|
|
|
[Fact]
|
|
public void CriticalFileChurnCreatesOnlyMediumConfidenceSignal()
|
|
{
|
|
var summary = new RansomwareFileChurnSummary
|
|
{
|
|
Enabled = true,
|
|
DataAvailable = true,
|
|
WindowMinutes = 15,
|
|
DeleteOperationCount = 200,
|
|
WriteOperationCount = 1000,
|
|
DistinctProcessCount = 1,
|
|
TopProcesses = [new RansomwareFileChurnProcess { Process = "encryptor.exe", DeleteOperationCount = 200, WriteOperationCount = 1000 }]
|
|
};
|
|
|
|
RansomwareSignal? signal = RansomwareFileChurnDetector.CreateSignal(summary, new ScannerConfiguration());
|
|
|
|
Assert.NotNull(signal);
|
|
Assert.Equal("file-churn-critical", signal.Category);
|
|
Assert.Equal("medium", signal.Confidence);
|
|
Assert.Equal("encryptor.exe", signal.Process);
|
|
}
|
|
|
|
[Fact]
|
|
public void PassiveBetaCannotElevateNinjaAlertState()
|
|
{
|
|
var summary = new RansomwareBetaSummary { Enabled = true, State = "critical" };
|
|
|
|
Assert.False(RansomwareAlertPolicy.CanElevate(summary, alertingEnabled: false));
|
|
Assert.True(RansomwareAlertPolicy.CanElevate(summary, alertingEnabled: true));
|
|
}
|
|
}
|