TestExeObjParser/executableObject_pe_garble can fail on Windows

[elasticmachine]

💔 Tests Failed

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2023-06-06T17:05:40.954+0000

• Duration: 138 min 56 sec

Test stats 🧪

Test	Results
Failed	2
Passed	60080
Skipped	5953
Total	66035

Test errors

Expand to view the tests failures

ExtendedWin / auditbeat-windows-10-windows-10 / TestExeObjParser/executableObject_pe_garble – github.com/elastic/beats/v7/auditbeat/module/file_integrity

Expand to view the error details

 Failed 

Expand to view the stacktrace

 === RUN   TestExeObjParser/executableObject_pe_garble
    exeobjparser_test.go:46: unexpected error calling exeObjParser.Parse: open ./testdata/garble_pe_executable: The system cannot find the file specified.
    exeobjparser_test.go:72: unexpected error for garble_pe pe.import_hash: got:key not found want:<nil>
    exeobjparser_test.go:72: unexpected error for garble_pe pe.imphash: got:key not found want:<nil>
    exeobjparser_test.go:72: unexpected error for garble_pe pe.imports: got:key not found want:<nil>
    exeobjparser_test.go:72: unexpected error for garble_pe pe.imports_names_entropy: got:key not found want:<nil>
    exeobjparser_test.go:72: unexpected error for garble_pe pe.imports_names_var_entropy: got:key not found want:<nil>
    exeobjparser_test.go:72: unexpected error for garble_pe pe.go_import_hash: got:key not found want:<nil>
    exeobjparser_test.go:72: unexpected error for garble_pe pe.go_stripped: got:key not found want:<nil>
    exeobjparser_test.go:72: unexpected error for garble_pe pe.sections: got:key not found want:<nil>
    --- FAIL: TestExeObjParser/executableObject_pe_garble (0.00s)
 

ExtendedWin / auditbeat-windows-10-windows-10 / TestExeObjParser – github.com/elastic/beats/v7/auditbeat/module/file_integrity

Expand to view the error details

 Failed 

Expand to view the stacktrace

 === RUN   TestExeObjParser
--- FAIL: TestExeObjParser (0.06s)
 

Steps errors

Expand to view the steps failures

filebeat-arm-ubuntu-2204-aarch64 - mage build unitTest

• Took 12 min 8 sec . View more details here
• Description: mage build unitTest

auditbeat-windows-10-windows-10 - mage build unitTest

• Took 3 min 21 sec . View more details here
• Description: mage build unitTest

auditbeat-windows-10-windows-10 - mage build unitTest

• Took 3 min 52 sec . View more details here
• Description: mage build unitTest

auditbeat-windows-10-windows-10 - mage build unitTest

• Took 1 min 50 sec . View more details here
• Description: mage build unitTest

Error signal

• Took 0 min 0 sec . View more details here
• Description: Error "hudson.AbortException: script returned exit code 1"

[elasticmachine]

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[ebeahan]

Some vendors (including Elastic) flag garble_pe_executable as a malicious file. Even though Microsoft isn't listed as one of the vendors on VT, appears Defender is starting to flag it as malicious during test runs:

[2023-06-06T19:05:20.231Z] === FAIL: auditbeat/module/file_integrity TestExeObjParser/executableObject_pe_garble (0.71s)
[2023-06-06T19:05:20.231Z]     exeobjparser_test.go:46: unexpected error calling exeObjParser.Parse: open ./testdata/garble_pe_executable: Operation did not complete successfully because the file contains a virus or potentially unwanted software.
[2023-06-06T19:05:20.231Z]     exeobjparser_test.go:72: unexpected error for garble_pe pe.import_hash: got:key not found want:<nil>
[2023-06-06T19:05:20.231Z]     exeobjparser_test.go:72: unexpected error for garble_pe pe.imphash: got:key not found want:<nil>
[2023-06-06T19:05:20.231Z]     exeobjparser_test.go:72: unexpected error for garble_pe pe.imports: got:key not found want:<nil>
[2023-06-06T19:05:20.231Z]     exeobjparser_test.go:72: unexpected error for garble_pe pe.imports_names_entropy: got:key not found want:<nil>
[2023-06-06T19:05:20.231Z]     exeobjparser_test.go:72: unexpected error for garble_pe pe.imports_names_var_entropy: got:key not found want:<nil>
[2023-06-06T19:05:20.231Z]     exeobjparser_test.go:72: unexpected error for garble_pe pe.go_import_hash: got:key not found want:<nil>
[2023-06-06T19:05:20.231Z]     exeobjparser_test.go:72: unexpected error for garble_pe pe.go_stripped: got:key not found want:<nil>
[2023-06-06T19:05:20.231Z]     exeobjparser_test.go:72: unexpected error for garble_pe pe.sections: got:key not found want:<nil>
[2023-06-06T19:05:20.231Z]     --- FAIL: TestExeObjParser/executableObject_pe_garble (0.71s)
[2023-06-06T19:05:20.231Z] 
[2023-06-06T19:05:20.231Z] === FAIL: auditbeat/module/file_integrity TestExeObjParser (1.38s)
[2023-06-06T19:05:20.231Z] 
[2023-06-06T19:05:20.231Z] DONE 98 tests, 5 skipped, 2 failures in 85.263s
[2023-06-06T19:05:21.244Z] Error: failed to execute go: exit status 1
script returned exit code 1

EDIT: Tested and confirmed the file is marked as malicious and quarantined on Windows 10:

Windows 10 21H1 (OS Build 19043.2364)
Windows Defender Security intelligence version: 1.391.851.0

[efd6]

We can remove that test if it's causing problems.

[efd6]

PR at #35724.