auditbeat/module/file_integrity: remove garbled PE executable test file

This file is detected by some malware detection systems as malicious likely due to the source obfuscation that garble does to it. The testing of the underlying library already tests the infrastucture, so removing the test here does not harm coverage. The executable itself is a garble built compilation of the file at https://github.com/elastic/toutoumomoma/blob/dev/testdata/main.go. In that repository the executable is built on the fly during testing rather than being retained as an asset.
elastic · Jun 8, 2023 · d18fb8e · d18fb8e
1 parent f694f39
commit d18fb8e
Show file tree

Hide file tree

Showing 3 changed files with 5 additions and 60 deletions.
diff --git a/CHANGELOG-developer.next.asciidoc b/CHANGELOG-developer.next.asciidoc
@@ -165,3 +165,4 @@ The list below covers the major changes between 7.0.0-rc2 and main only.
 
 - Deprecated the `common.Float` type. {issue}28279[28279] {pull}28280[28280]
 - Deprecate Beat generators. {pull}28814[28814]
+- Remove garbled PE executable test from auditbeat FIM module testing. {issue}35705[35705] {pull}[]
diff --git a/auditbeat/module/file_integrity/exeobjparser_test.go b/auditbeat/module/file_integrity/exeobjparser_test.go
@@ -40,6 +40,10 @@ func TestExeObjParser(t *testing.T) {
 
 			key := fmt.Sprintf("%s_%s", builder, format)
 			t.Run(fmt.Sprintf("executableObject_%s_%s", format, builder), func(t *testing.T) {
+				if builder == "garble" && format == "pe" {
+					t.Skip("skipping test on garbled PE file: see https://github.com/elastic/beats/issues/35705")
+				}
+
 				got := make(mapstr.M)
 				err := exeObjParser(nil).Parse(got, target)
 				if err != nil {
@@ -262,66 +266,6 @@ var want = map[string]mapstr.M{
 			},
 		},
 	},
-	"garble_pe": {
-		"pe": mapstr.M{
-			"import_hash": "c7269d59926fa4252270f407e4dab043",
-			"imphash":     "c7269d59926fa4252270f407e4dab043",
-			"imports": []string{
-				"kernel32.writefile",
-				"kernel32.writeconsolew",
-				"kernel32.waitformultipleobjects",
-				"kernel32.waitforsingleobject",
-				"kernel32.virtualquery",
-				"kernel32.virtualfree",
-				"kernel32.virtualalloc",
-				"kernel32.switchtothread",
-				"kernel32.suspendthread",
-				"kernel32.sleep",
-				"kernel32.setwaitabletimer",
-				"kernel32.setunhandledexceptionfilter",
-				"kernel32.setprocesspriorityboost",
-				"kernel32.setevent",
-				"kernel32.seterrormode",
-				"kernel32.setconsolectrlhandler",
-				"kernel32.resumethread",
-				"kernel32.postqueuedcompletionstatus",
-				"kernel32.loadlibrarya",
-				"kernel32.loadlibraryw",
-				"kernel32.setthreadcontext",
-				"kernel32.getthreadcontext",
-				"kernel32.getsysteminfo",
-				"kernel32.getsystemdirectorya",
-				"kernel32.getstdhandle",
-				"kernel32.getqueuedcompletionstatusex",
-				"kernel32.getprocessaffinitymask",
-				"kernel32.getprocaddress",
-				"kernel32.getenvironmentstringsw",
-				"kernel32.getconsolemode",
-				"kernel32.freeenvironmentstringsw",
-				"kernel32.exitprocess",
-				"kernel32.duplicatehandle",
-				"kernel32.createwaitabletimerexw",
-				"kernel32.createthread",
-				"kernel32.createiocompletionport",
-				"kernel32.createfilea",
-				"kernel32.createeventa",
-				"kernel32.closehandle",
-				"kernel32.addvectoredexceptionhandler",
-			},
-			"imports_names_entropy":     4.2079021689106195,
-			"imports_names_var_entropy": 0.0014785066641319837,
-			"go_import_hash":            "d41d8cd98f00b204e9800998ecf8427e",
-			"go_stripped":               true,
-			"sections": []objSection{
-				{Name: strPtr(".text"), Size: uint64Ptr(0x83000), Entropy: float64Ptr(6.18), VarEntropy: float64Ptr(0.0001)},
-				{Name: strPtr(".rdata"), Size: uint64Ptr(0x97a00), Entropy: float64Ptr(5.10), VarEntropy: float64Ptr(0.0001)},
-				{Name: strPtr(".data"), Size: uint64Ptr(0x17800), Entropy: float64Ptr(4.60), VarEntropy: float64Ptr(0.0001)},
-				{Name: strPtr(".idata"), Size: uint64Ptr(0x600), Entropy: float64Ptr(3.60), VarEntropy: float64Ptr(0.0001)},
-				{Name: strPtr(".reloc"), Size: uint64Ptr(0x6800), Entropy: float64Ptr(5.42), VarEntropy: float64Ptr(0.0001)},
-				{Name: strPtr(".symtab"), Size: uint64Ptr(0x200), Entropy: float64Ptr(0.02), VarEntropy: float64Ptr(0.0001)},
-			},
-		},
-	},
 	"go_elf": {
 		"elf": mapstr.M{
 			"go_imports_names_entropy":     4.156563879566413,

diff --git a/auditbeat/module/file_integrity/testdata/garble_pe_executable b/auditbeat/module/file_integrity/testdata/garble_pe_executable