malware_test.go

// Copyright 2020 Joakim Kennedy. All rights reserved. Use of
// this source code is governed by the included BSD license.

package stix2

import (
	"encoding/json"
	"testing"
	"time"

	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"
)

func TestMalware(t *testing.T) {
	assert := assert.New(t)

	t.Run("no_optional", func(t *testing.T) {
		obj, err := NewMalware(false, nil)
		assert.NotNil(obj)
		assert.NoError(err)
	})

	t.Run("with_options", func(t *testing.T) {
		conf := 50
		desc := "My description"
		ts := &Timestamp{time.Now()}
		createdBy := NewIdentifier(TypeIdentity)
		ref := &ExternalReference{}
		marking := make([]*GranularMarking, 0)
		labels := []string{"tag1", "tag2"}
		lang := "en"
		objmark := []Identifier{Identifier("id")}
		specVer := "2.0"

		name := "new name"
		typs := []string{MalwareTypeBot}
		aliases := []string{"Name 1", "Name 2"}
		kcf := []*KillChainPhase{{}}
		os := []Identifier{NewObservableIdentifier("Windows", TypeSoftware)}
		arch := []string{ArchitectureX8664}
		langu := []string{ImplementationLanguageGo}
		capa := []string{MalwareCapabilitiesCommunicatesWithC2}
		samples := []Identifier{createdBy}

		opts := []STIXOption{
			OptionConfidence(conf),
			OptionCreated(ts),
			OptionModified(ts),
			OptionCreatedBy(createdBy),
			OptionExternalReferences([]*ExternalReference{ref}),
			OptionGranularMarking(marking),
			OptionLabels(labels),
			OptionLang(lang),
			OptionObjectMarking(objmark),
			OptionRevoked(true),
			OptionSpecVersion(specVer),
			//
			OptionDescription(desc),
			OptionName(name),
			OptionTypes(typs),
			OptionAliases(aliases),
			OptionKillChainPhase(kcf),
			OptionFirstSeen(ts),
			OptionLastSeen(ts),
			OptionOperatingSystems(os),
			OptionArchitecture(arch),
			OptionLanguages(langu),
			OptionCapabilities(capa),
			OptionSamples(samples),
		}
		obj, err := NewMalware(true, opts...)
		assert.NotNil(obj)
		assert.NoError(err)
		assert.Equal(conf, obj.Confidence)
		assert.Equal(ts, obj.Created)
		assert.Equal(ts, obj.Modified)
		assert.Equal(createdBy, obj.CreatedBy)
		assert.Contains(obj.ExternalReferences, ref)
		assert.Equal(marking, obj.GranularMarking)
		assert.Equal(labels, obj.Labels)
		assert.Equal(lang, obj.Lang)
		assert.Equal(objmark, obj.ObjectMarking)
		assert.True(obj.Revoked)
		assert.Equal(specVer, obj.SpecVersion)

		assert.Equal(desc, obj.Description)
		assert.Equal(name, obj.Name)
		assert.Equal(typs, obj.Types)
		assert.Equal(aliases, obj.Aliases)
		assert.Equal(kcf, obj.KillChainPhase)
		assert.Equal(ts, obj.FirstSeen)
		assert.Equal(ts, obj.LastSeen)
		assert.Equal(os, obj.OperatingSystems)
		assert.Equal(arch, obj.Architecture)
		assert.Equal(langu, obj.Languages)
		assert.Equal(capa, obj.Capabilities)
		assert.Equal(samples, obj.Samples)
	})

	t.Run("family-and-name", func(t *testing.T) {
		tests := []struct {
			fam bool
			nam string
			err error
		}{
			{false, "", nil},
			{false, "name", nil},
			{true, "name", nil},
			{true, "", ErrInvalidProperty},
		}
		for _, test := range tests {
			_, err := NewMalware(test.fam, OptionName(test.nam))
			assert.Equal(test.err, err)
		}
	})

	t.Run("parse_json", func(t *testing.T) {
		data := []byte(`{
  "type": "malware",
  "spec_version": "2.1",
  "id": "malware--0c7b5b88-8ff7-4a4d-aa9d-feb398cd0061",
  "created": "2016-05-12T08:17:27.000Z",
  "modified": "2016-05-12T08:17:27.000Z",
  "name": "Cryptolocker",
  "description": "A variant of the cryptolocker family",
  "malware_types": ["ransomware"],
  "is_family": false
}`)
		ts, err := time.Parse(time.RFC3339Nano, "2016-05-12T08:17:27.000Z")
		assert.NoError(err)
		var obj *Malware
		err = json.Unmarshal(data, &obj)
		assert.NoError(err)
		assert.Equal(Identifier("malware--0c7b5b88-8ff7-4a4d-aa9d-feb398cd0061"), obj.ID)
		assert.Equal("2.1", obj.SpecVersion)
		assert.Equal(TypeMalware, obj.Type)
		assert.Equal(ts, obj.Created.Time)
		assert.Equal(ts, obj.Modified.Time)
		assert.Equal("Cryptolocker", obj.Name)
		assert.Equal("A variant of the cryptolocker family", obj.Description)
		assert.Equal([]string{MalwareTypeRansomware}, obj.Types)
		assert.False(obj.IsFamily)
	})
}

func TestMalwareAuthoredBy(t *testing.T) {
	assert := assert.New(t)

	t.Run("threat-actor", func(t *testing.T) {
		obj, err := NewMalware(false)
		assert.NoError(err)
		id := NewIdentifier(TypeThreatActor)
		rel, err := obj.AddAuthoredBy(id)
		assert.NoError(err)
		assert.Equal(id, rel.Target)
		assert.Equal(obj.ID, rel.Source)
		assert.Equal(RelationshipTypeAuthoredBy, rel.RelationshipType)
	})

	t.Run("intrusion-set", func(t *testing.T) {
		obj, err := NewMalware(false)
		assert.NoError(err)
		id := NewIdentifier(TypeIntrusionSet)
		rel, err := obj.AddAuthoredBy(id)
		assert.NoError(err)
		assert.Equal(id, rel.Target)
		assert.Equal(obj.ID, rel.Source)
		assert.Equal(RelationshipTypeAuthoredBy, rel.RelationshipType)
	})

	t.Run("invalid_type", func(t *testing.T) {
		obj, err := NewMalware(false)
		assert.NoError(err)
		id := NewIdentifier(TypeIPv4Addr)
		rel, err := obj.AddAuthoredBy(id)
		assert.Equal(err, ErrInvalidParameter)
		assert.Nil(rel)
	})
}

func TestMalwareBeaconsTo(t *testing.T) {
	assert := assert.New(t)

	t.Run("infrastructure", func(t *testing.T) {
		obj, err := NewMalware(false)
		assert.NoError(err)
		id := NewIdentifier(TypeInfrastructure)
		rel, err := obj.AddBeaconsTo(id)
		assert.NoError(err)
		assert.Equal(id, rel.Target)
		assert.Equal(obj.ID, rel.Source)
		assert.Equal(RelationshipTypeBeaconsTo, rel.RelationshipType)
	})

	t.Run("invalid_type", func(t *testing.T) {
		obj, err := NewMalware(false)
		assert.NoError(err)
		id := NewIdentifier(TypeIPv4Addr)
		rel, err := obj.AddBeaconsTo(id)
		assert.Equal(err, ErrInvalidParameter)
		assert.Nil(rel)
	})
}

func TestMalwareExfiltratesTo(t *testing.T) {
	assert := assert.New(t)

	t.Run("infrastructure", func(t *testing.T) {
		obj, err := NewMalware(false)
		assert.NoError(err)
		id := NewIdentifier(TypeInfrastructure)
		rel, err := obj.AddExfiltratesTo(id)
		assert.NoError(err)
		assert.Equal(id, rel.Target)
		assert.Equal(obj.ID, rel.Source)
		assert.Equal(RelationshipTypeExfiltratesTo, rel.RelationshipType)
	})

	t.Run("invalid_type", func(t *testing.T) {
		obj, err := NewMalware(false)
		assert.NoError(err)
		id := NewIdentifier(TypeIPv4Addr)
		rel, err := obj.AddExfiltratesTo(id)
		assert.Equal(err, ErrInvalidParameter)
		assert.Nil(rel)
	})
}

func TestMalwareCommunicatesWith(t *testing.T) {
	assert := assert.New(t)

	t.Run("IPv4", func(t *testing.T) {
		obj, err := NewMalware(false)
		assert.NoError(err)
		id := NewIdentifier(TypeIPv4Addr)
		rel, err := obj.AddCommunicatesWith(id)
		assert.NoError(err)
		assert.Equal(id, rel.Target)
		assert.Equal(obj.ID, rel.Source)
		assert.Equal(RelationshipTypeCommunicatesWith, rel.RelationshipType)
	})

	t.Run("IPv6", func(t *testing.T) {
		obj, err := NewMalware(false)
		assert.NoError(err)
		id := NewIdentifier(TypeIPv6Addr)
		rel, err := obj.AddCommunicatesWith(id)
		assert.NoError(err)
		assert.Equal(id, rel.Target)
		assert.Equal(obj.ID, rel.Source)
		assert.Equal(RelationshipTypeCommunicatesWith, rel.RelationshipType)
	})

	t.Run("domain", func(t *testing.T) {
		obj, err := NewMalware(false)
		assert.NoError(err)
		id := NewIdentifier(TypeDomainName)
		rel, err := obj.AddCommunicatesWith(id)
		assert.NoError(err)
		assert.Equal(id, rel.Target)
		assert.Equal(obj.ID, rel.Source)
		assert.Equal(RelationshipTypeCommunicatesWith, rel.RelationshipType)
	})

	t.Run("URL", func(t *testing.T) {
		obj, err := NewMalware(false)
		assert.NoError(err)
		id := NewIdentifier(TypeURL)
		rel, err := obj.AddCommunicatesWith(id)
		assert.NoError(err)
		assert.Equal(id, rel.Target)
		assert.Equal(obj.ID, rel.Source)
		assert.Equal(RelationshipTypeCommunicatesWith, rel.RelationshipType)
	})

	t.Run("invalid_type", func(t *testing.T) {
		obj, err := NewMalware(false)
		assert.NoError(err)
		id := NewIdentifier(TypeMalware)
		rel, err := obj.AddCommunicatesWith(id)
		assert.Equal(err, ErrInvalidParameter)
		assert.Nil(rel)
	})
}

func TestMalwareControls(t *testing.T) {
	assert := assert.New(t)

	t.Run("malware", func(t *testing.T) {
		obj, err := NewMalware(false)
		assert.NoError(err)
		id := NewIdentifier(TypeMalware)
		rel, err := obj.AddControls(id)
		assert.NoError(err)
		assert.Equal(id, rel.Target)
		assert.Equal(obj.ID, rel.Source)
		assert.Equal(RelationshipTypeControls, rel.RelationshipType)
	})

	t.Run("invalid_type", func(t *testing.T) {
		obj, err := NewMalware(false)
		assert.NoError(err)
		id := NewIdentifier(TypeIPv4Addr)
		rel, err := obj.AddControls(id)
		assert.Equal(err, ErrInvalidParameter)
		assert.Nil(rel)
	})
}

func TestMalwareDownloads(t *testing.T) {
	assert := assert.New(t)

	t.Run("malware", func(t *testing.T) {
		obj, err := NewMalware(false)
		assert.NoError(err)
		id := NewIdentifier(TypeMalware)
		rel, err := obj.AddDownloads(id)
		assert.NoError(err)
		assert.Equal(id, rel.Target)
		assert.Equal(obj.ID, rel.Source)
		assert.Equal(RelationshipTypeDownloads, rel.RelationshipType)
	})

	t.Run("tool", func(t *testing.T) {
		obj, err := NewMalware(false)
		assert.NoError(err)
		id := NewIdentifier(TypeTool)
		rel, err := obj.AddDownloads(id)
		assert.NoError(err)
		assert.Equal(id, rel.Target)
		assert.Equal(obj.ID, rel.Source)
		assert.Equal(RelationshipTypeDownloads, rel.RelationshipType)
	})

	t.Run("file", func(t *testing.T) {
		obj, err := NewMalware(false)
		assert.NoError(err)
		id := NewIdentifier(TypeFile)
		rel, err := obj.AddDownloads(id)
		assert.NoError(err)
		assert.Equal(id, rel.Target)
		assert.Equal(obj.ID, rel.Source)
		assert.Equal(RelationshipTypeDownloads, rel.RelationshipType)
	})

	t.Run("invalid_type", func(t *testing.T) {
		obj, err := NewMalware(false)
		assert.NoError(err)
		id := NewIdentifier(TypeIPv4Addr)
		rel, err := obj.AddDownloads(id)
		assert.Equal(err, ErrInvalidParameter)
		assert.Nil(rel)
	})
}

func TestMalwareDrops(t *testing.T) {
	assert := assert.New(t)

	t.Run("malware", func(t *testing.T) {
		obj, err := NewMalware(false)
		assert.NoError(err)
		id := NewIdentifier(TypeMalware)
		rel, err := obj.AddDrops(id)
		assert.NoError(err)
		assert.Equal(id, rel.Target)
		assert.Equal(obj.ID, rel.Source)
		assert.Equal(RelationshipTypeDrops, rel.RelationshipType)
	})

	t.Run("tool", func(t *testing.T) {
		obj, err := NewMalware(false)
		assert.NoError(err)
		id := NewIdentifier(TypeTool)
		rel, err := obj.AddDrops(id)
		assert.NoError(err)
		assert.Equal(id, rel.Target)
		assert.Equal(obj.ID, rel.Source)
		assert.Equal(RelationshipTypeDrops, rel.RelationshipType)
	})

	t.Run("file", func(t *testing.T) {
		obj, err := NewMalware(false)
		assert.NoError(err)
		id := NewIdentifier(TypeFile)
		rel, err := obj.AddDrops(id)
		assert.NoError(err)
		assert.Equal(id, rel.Target)
		assert.Equal(obj.ID, rel.Source)
		assert.Equal(RelationshipTypeDrops, rel.RelationshipType)
	})

	t.Run("invalid_type", func(t *testing.T) {
		obj, err := NewMalware(false)
		assert.NoError(err)
		id := NewIdentifier(TypeIPv4Addr)
		rel, err := obj.AddDrops(id)
		assert.Equal(err, ErrInvalidParameter)
		assert.Nil(rel)
	})
}

func TestMalwareExploits(t *testing.T) {
	assert := assert.New(t)

	t.Run("vulnerability", func(t *testing.T) {
		obj, err := NewMalware(false)
		assert.NoError(err)
		id := NewIdentifier(TypeVulnerability)
		rel, err := obj.AddExploits(id)
		assert.NoError(err)
		assert.Equal(id, rel.Target)
		assert.Equal(obj.ID, rel.Source)
		assert.Equal(RelationshipTypeExploits, rel.RelationshipType)
	})

	t.Run("invalid_type", func(t *testing.T) {
		obj, err := NewMalware(false)
		assert.NoError(err)
		id := NewIdentifier(TypeIPv4Addr)
		rel, err := obj.AddExploits(id)
		assert.Equal(err, ErrInvalidParameter)
		assert.Nil(rel)
	})
}

func TestMalwareOriginatesFrom(t *testing.T) {
	assert := assert.New(t)

	t.Run("location", func(t *testing.T) {
		obj, err := NewMalware(false)
		assert.NoError(err)
		id := NewIdentifier(TypeLocation)
		rel, err := obj.AddOriginatesFrom(id)
		assert.NoError(err)
		assert.Equal(id, rel.Target)
		assert.Equal(obj.ID, rel.Source)
		assert.Equal(RelationshipTypeOriginatesFrom, rel.RelationshipType)
	})

	t.Run("invalid_type", func(t *testing.T) {
		obj, err := NewMalware(false)
		assert.NoError(err)
		id := NewIdentifier(TypeIPv4Addr)
		rel, err := obj.AddOriginatesFrom(id)
		assert.Equal(err, ErrInvalidParameter)
		assert.Nil(rel)
	})
}

func TestMalwareTargets(t *testing.T) {
	assert := assert.New(t)

	t.Run("identity", func(t *testing.T) {
		obj, err := NewMalware(false)
		assert.NoError(err)
		id := NewIdentifier(TypeIdentity)
		rel, err := obj.AddTargets(id)
		assert.NoError(err)
		assert.Equal(id, rel.Target)
		assert.Equal(obj.ID, rel.Source)
		assert.Equal(RelationshipTypeTargets, rel.RelationshipType)
	})

	t.Run("infrastructure", func(t *testing.T) {
		obj, err := NewMalware(false)
		assert.NoError(err)
		id := NewIdentifier(TypeInfrastructure)
		rel, err := obj.AddTargets(id)
		assert.NoError(err)
		assert.Equal(id, rel.Target)
		assert.Equal(obj.ID, rel.Source)
		assert.Equal(RelationshipTypeTargets, rel.RelationshipType)
	})

	t.Run("location", func(t *testing.T) {
		obj, err := NewMalware(false)
		assert.NoError(err)
		id := NewIdentifier(TypeLocation)
		rel, err := obj.AddTargets(id)
		assert.NoError(err)
		assert.Equal(id, rel.Target)
		assert.Equal(obj.ID, rel.Source)
		assert.Equal(RelationshipTypeTargets, rel.RelationshipType)
	})

	t.Run("vulnerability", func(t *testing.T) {
		obj, err := NewMalware(false)
		assert.NoError(err)
		id := NewIdentifier(TypeVulnerability)
		rel, err := obj.AddTargets(id)
		assert.NoError(err)
		assert.Equal(id, rel.Target)
		assert.Equal(obj.ID, rel.Source)
		assert.Equal(RelationshipTypeTargets, rel.RelationshipType)
	})

	t.Run("invalid_type", func(t *testing.T) {
		obj, err := NewMalware(false)
		assert.NoError(err)
		id := NewIdentifier(TypeIPv4Addr)
		rel, err := obj.AddTargets(id)
		assert.Equal(err, ErrInvalidParameter)
		assert.Nil(rel)
	})
}

func TestMalwareUses(t *testing.T) {
	assert := assert.New(t)

	t.Run("attack-pattern", func(t *testing.T) {
		obj, err := NewMalware(false)
		assert.NoError(err)
		id := NewIdentifier(TypeAttackPattern)
		rel, err := obj.AddUses(id)
		assert.NoError(err)
		assert.Equal(id, rel.Target)
		assert.Equal(obj.ID, rel.Source)
		assert.Equal(RelationshipTypeUses, rel.RelationshipType)
	})

	t.Run("infrastructure", func(t *testing.T) {
		obj, err := NewMalware(false)
		assert.NoError(err)
		id := NewIdentifier(TypeInfrastructure)
		rel, err := obj.AddUses(id)
		assert.NoError(err)
		assert.Equal(id, rel.Target)
		assert.Equal(obj.ID, rel.Source)
		assert.Equal(RelationshipTypeUses, rel.RelationshipType)
	})

	t.Run("malware", func(t *testing.T) {
		obj, err := NewMalware(false)
		assert.NoError(err)
		id := NewIdentifier(TypeMalware)
		rel, err := obj.AddUses(id)
		assert.NoError(err)
		assert.Equal(id, rel.Target)
		assert.Equal(obj.ID, rel.Source)
		assert.Equal(RelationshipTypeUses, rel.RelationshipType)
	})

	t.Run("tool", func(t *testing.T) {
		obj, err := NewMalware(false)
		assert.NoError(err)
		id := NewIdentifier(TypeTool)
		rel, err := obj.AddUses(id)
		assert.NoError(err)
		assert.Equal(id, rel.Target)
		assert.Equal(obj.ID, rel.Source)
		assert.Equal(RelationshipTypeUses, rel.RelationshipType)
	})

	t.Run("invalid_type", func(t *testing.T) {
		obj, err := NewMalware(false)
		assert.NoError(err)
		id := NewIdentifier(TypeIPv4Addr)
		rel, err := obj.AddUses(id)
		assert.Equal(err, ErrInvalidParameter)
		assert.Nil(rel)
	})
}

func TestMalwareVariantOf(t *testing.T) {
	assert := assert.New(t)

	t.Run("malware", func(t *testing.T) {
		obj, err := NewMalware(false)
		assert.NoError(err)
		id := NewIdentifier(TypeMalware)
		rel, err := obj.AddVariantOf(id)
		assert.NoError(err)
		assert.Equal(id, rel.Target)
		assert.Equal(obj.ID, rel.Source)
		assert.Equal(RelationshipTypeVariantOf, rel.RelationshipType)
	})

	t.Run("invalid_type", func(t *testing.T) {
		obj, err := NewMalware(false)
		assert.NoError(err)
		id := NewIdentifier(TypeIPv4Addr)
		rel, err := obj.AddVariantOf(id)
		assert.Equal(err, ErrInvalidParameter)
		assert.Nil(rel)
	})
}

func TestMalwareTypes(t *testing.T) {
	r := require.New(t)
	m, e := NewMalware(false, OptionName("Test Malware"))
	r.NoError(e)

	_, e = json.Marshal(m)
	r.NoError(e)
}