Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

directory CONTAINED file relationship not working #472

Closed
pcoccoli opened this issue Feb 2, 2024 · 0 comments · Fixed by #473
Closed

directory CONTAINED file relationship not working #472

pcoccoli opened this issue Feb 2, 2024 · 0 comments · Fixed by #473
Assignees
Labels
bug Something isn't working

Comments

@pcoccoli
Copy link
Collaborator

pcoccoli commented Feb 2, 2024

Describe the bug
FIND directory CONTAINED x (when x is a file variable) returns nothing but FIND directory LINKED x for the same x does return.

Details of the bug
The problem stems from relation to STIX property resolution when the STIX property is a reference list. In this case, STIX defines a directory:contains_refs property. For reference properties that are NOT lists (i.e. end in _ref and point to a single object rather than a list of objects), Kestrel will first check if the property exists in the current session. For ref lists, this isn't done.

To Reproduce
Unit test to show the problem:

def test_find_dir_contained_file(set_empty_kestrel_config, proc_bundle_file):
    with Session() as s:
        stmt = f"""
                files = GET file
                        FROM file://{proc_bundle_file}
                        WHERE name = 'svchost.exe'
                dirs = FIND directory CONTAINED files
                """
        s.execute(stmt)
        files = s.get_variable("files")
        print(json.dumps(files, indent=4))
        dirs = s.get_variable("dirs")
        print(json.dumps(dirs, indent=4))
        assert len(dirs) == 1

This test will fail if the "contains_refs" property doesn't appear in the STIX bundle (it usually does not). However, it should pass since file:parent_directory_ref is there.

@pcoccoli pcoccoli added the bug Something isn't working label Feb 2, 2024
@pcoccoli pcoccoli self-assigned this Feb 2, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant