auditbeat/module/file_integrity: remove garbled PE executable test fi…

…le (#35724) This file is detected by some malware detection systems as malicious likely due to the source obfuscation that garble does to it. The testing of the underlying library already tests the infrastucture, so removing the test here does not harm coverage. The executable itself is a garble built compilation of the file at https://github.com/elastic/toutoumomoma/blob/dev/testdata/main.go. In that repository the executable is built on the fly during testing rather than being retained as an asset.
elastic · Jun 12, 2023 · 7ad2548 · 7ad2548
1 parent 5ec2a53
commit 7ad2548
Show file tree

Hide file tree

Showing 3 changed files with 5 additions and 60 deletions.
diff --git a/CHANGELOG-developer.next.asciidoc b/CHANGELOG-developer.next.asciidoc
@@ -165,3 +165,4 @@ The list below covers the major changes between 7.0.0-rc2 and main only.
 
 - Deprecated the `common.Float` type. {issue}28279[28279] {pull}28280[28280]
 - Deprecate Beat generators. {pull}28814[28814]
+- Remove garbled PE executable test from auditbeat FIM module testing. {issue}35705[35705] {pull}35724[35724]
diff --git a/auditbeat/module/file_integrity/exeobjparser_test.go b/auditbeat/module/file_integrity/exeobjparser_test.go
@@ -40,6 +40,10 @@ func TestExeObjParser(t *testing.T) {
 
 			key := fmt.Sprintf("%s_%s", builder, format)
 			t.Run(fmt.Sprintf("executableObject_%s_%s", format, builder), func(t *testing.T) {
+				if builder == "garble" && format == "pe" {
+					t.Skip("skipping test on garbled PE file: see https://github.com/elastic/beats/issues/35705")
+				}
+
 				got := make(mapstr.M)
 				err := exeObjParser(nil).Parse(got, target)
 				if err != nil {
@@ -262,66 +266,6 @@ var want = map[string]mapstr.M{
 			},
 		},
 	},
-	"garble_pe": {
-		"pe": mapstr.M{
-			"import_hash": "c7269d59926fa4252270f407e4dab043",
-			"imphash":     "c7269d59926fa4252270f407e4dab043",
-			"imports": []string{
-				"kernel32.writefile",
-				"kernel32.writeconsolew",
-				"kernel32.waitformultipleobjects",
-				"kernel32.waitforsingleobject",
-				"kernel32.virtualquery",
-				"kernel32.virtualfree",
-				"kernel32.virtualalloc",
-				"kernel32.switchtothread",
-				"kernel32.suspendthread",
-				"kernel32.sleep",
-				"kernel32.setwaitabletimer",
-				"kernel32.setunhandledexceptionfilter",
-				"kernel32.setprocesspriorityboost",
-				"kernel32.setevent",
-				"kernel32.seterrormode",
-				"kernel32.setconsolectrlhandler",
-				"kernel32.resumethread",
-				"kernel32.postqueuedcompletionstatus",
-				"kernel32.loadlibrarya",
-				"kernel32.loadlibraryw",
-				"kernel32.setthreadcontext",
-				"kernel32.getthreadcontext",
-				"kernel32.getsysteminfo",
-				"kernel32.getsystemdirectorya",
-				"kernel32.getstdhandle",
-				"kernel32.getqueuedcompletionstatusex",
-				"kernel32.getprocessaffinitymask",
-				"kernel32.getprocaddress",
-				"kernel32.getenvironmentstringsw",
-				"kernel32.getconsolemode",
-				"kernel32.freeenvironmentstringsw",
-				"kernel32.exitprocess",
-				"kernel32.duplicatehandle",
-				"kernel32.createwaitabletimerexw",
-				"kernel32.createthread",
-				"kernel32.createiocompletionport",
-				"kernel32.createfilea",
-				"kernel32.createeventa",
-				"kernel32.closehandle",
-				"kernel32.addvectoredexceptionhandler",
-			},
-			"imports_names_entropy":     4.2079021689106195,
-			"imports_names_var_entropy": 0.0014785066641319837,
-			"go_import_hash":            "d41d8cd98f00b204e9800998ecf8427e",
-			"go_stripped":               true,
-			"sections": []objSection{
-				{Name: strPtr(".text"), Size: uint64Ptr(0x83000), Entropy: float64Ptr(6.18), VarEntropy: float64Ptr(0.0001)},
-				{Name: strPtr(".rdata"), Size: uint64Ptr(0x97a00), Entropy: float64Ptr(5.10), VarEntropy: float64Ptr(0.0001)},
-				{Name: strPtr(".data"), Size: uint64Ptr(0x17800), Entropy: float64Ptr(4.60), VarEntropy: float64Ptr(0.0001)},
-				{Name: strPtr(".idata"), Size: uint64Ptr(0x600), Entropy: float64Ptr(3.60), VarEntropy: float64Ptr(0.0001)},
-				{Name: strPtr(".reloc"), Size: uint64Ptr(0x6800), Entropy: float64Ptr(5.42), VarEntropy: float64Ptr(0.0001)},
-				{Name: strPtr(".symtab"), Size: uint64Ptr(0x200), Entropy: float64Ptr(0.02), VarEntropy: float64Ptr(0.0001)},
-			},
-		},
-	},
 	"go_elf": {
 		"elf": mapstr.M{
 			"go_imports_names_entropy":     4.156563879566413,

diff --git a/auditbeat/module/file_integrity/testdata/garble_pe_executable b/auditbeat/module/file_integrity/testdata/garble_pe_executable