Move defender tests to main test repo

MythicAgents · Feb 16, 2024 · a5a8011 · a5a8011
1 parent 14aa683
commit a5a8011
Show file tree

Hide file tree

Showing 14 changed files with 6 additions and 229 deletions.
diff --git a/Payload_Type/athena/athena/agent_code/Agent.sln b/Payload_Type/athena/athena/agent_code/Agent.sln
@@ -161,8 +161,6 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Tests", "Tests", "{2B702357
 EndProject
 Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "Agent.Tests", "Tests\Agent.Tests\Agent.Tests.csproj", "{4C02C683-28E5-4CA9-B4BF-CD429A08DEC0}"
 EndProject
-Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Agent.Tests.Defender", "Tests\Agent.Tests.Defender\Agent.Tests.Defender.csproj", "{87233567-B852-400A-B8BE-B88BA89138C2}"
-EndProject
 Global
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
 		Debug|Any CPU = Debug|Any CPU
@@ -461,10 +459,6 @@ Global
 		{4C02C683-28E5-4CA9-B4BF-CD429A08DEC0}.Debug|Any CPU.Build.0 = Debug|Any CPU
 		{4C02C683-28E5-4CA9-B4BF-CD429A08DEC0}.Release|Any CPU.ActiveCfg = Release|Any CPU
 		{4C02C683-28E5-4CA9-B4BF-CD429A08DEC0}.Release|Any CPU.Build.0 = Release|Any CPU
-		{87233567-B852-400A-B8BE-B88BA89138C2}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
-		{87233567-B852-400A-B8BE-B88BA89138C2}.Debug|Any CPU.Build.0 = Debug|Any CPU
-		{87233567-B852-400A-B8BE-B88BA89138C2}.Release|Any CPU.ActiveCfg = Release|Any CPU
-		{87233567-B852-400A-B8BE-B88BA89138C2}.Release|Any CPU.Build.0 = Release|Any CPU
 	EndGlobalSection
 	GlobalSection(SolutionProperties) = preSolution
 		HideSolutionNode = FALSE
@@ -546,7 +540,6 @@ Global
 		{1E847515-2E5B-48A3-B267-3800CFF98338} = {E014E0E5-A190-4AAF-A0E9-01DA299A4E21}
 		{D7F1F1D7-234E-4CE9-B1F4-6E3A1292BB5D} = {E014E0E5-A190-4AAF-A0E9-01DA299A4E21}
 		{4C02C683-28E5-4CA9-B4BF-CD429A08DEC0} = {2B702357-DFFB-40D0-B3F9-93D06FDAD37D}
-		{87233567-B852-400A-B8BE-B88BA89138C2} = {2B702357-DFFB-40D0-B3F9-93D06FDAD37D}
 	EndGlobalSection
 	GlobalSection(ExtensibilityGlobals) = postSolution
 		SolutionGuid = {A98FF3E6-31F5-4EE0-BA47-B440723219ED}

diff --git a/Payload_Type/athena/athena/agent_code/Tests/Agent.Tests.Defender/Agent.Tests.Defender.csproj b/Payload_Type/athena/athena/agent_code/Tests/Agent.Tests.Defender/Agent.Tests.Defender.csproj
diff --git a/Payload_Type/athena/athena/agent_code/Tests/Agent.Tests.Defender/Properties/AssemblyInfo.cs b/Payload_Type/athena/athena/agent_code/Tests/Agent.Tests.Defender/Properties/AssemblyInfo.cs
diff --git a/Payload_Type/athena/athena/agent_code/Tests/Agent.Tests.Defender/app.config b/Payload_Type/athena/athena/agent_code/Tests/Agent.Tests.Defender/app.config
diff --git a/Payload_Type/athena/athena/agent_code/Tests/Agent.Tests.Defender/packages.config b/Payload_Type/athena/athena/agent_code/Tests/Agent.Tests.Defender/packages.config
diff --git a/Payload_Type/athena/athena/agent_code/Tests/Agent.Tests/Agent.Tests.csproj b/Payload_Type/athena/athena/agent_code/Tests/Agent.Tests/Agent.Tests.csproj
@@ -72,4 +72,8 @@
     <ProjectReference Include="..\..\whoami\whoami.csproj" />
   </ItemGroup>
 
+  <ItemGroup>
+    <Folder Include="DefenderTests\Checker\amsi\" />
+  </ItemGroup>
+
 </Project>
diff --git a/...e/Tests/Agent.Tests.Defender/AmsiTests.cs → ...ts/Agent.Tests/DefenderTests/AmsiTests.cs b/...e/Tests/Agent.Tests.Defender/AmsiTests.cs → ...ts/Agent.Tests/DefenderTests/AmsiTests.cs
@@ -17,7 +17,7 @@ public class AmsiTests
         public void ScanFiles()
         {
             bool malicious = false;
-            string parent_dir = Directory.GetParent(Directory.GetCurrentDirectory()).Parent.Parent.Parent.FullName;
+            string parent_dir = Directory.GetParent(Directory.GetCurrentDirectory()).Parent.Parent.Parent.Parent.FullName; //How deep does the rabbit hole go?
             foreach (string file in Directory.EnumerateFiles(parent_dir, "*.dll*", SearchOption.AllDirectories))
             {
                 if (file.Contains("Agent.Tests") || file.Contains("\\obj\\")) //Windows only so this should be fine
@@ -48,22 +48,5 @@ public void ScanFiles()
 
             Assert.IsFalse(malicious);
         }
-
-        private bool ScanWithAmsi(byte[] file)
-        {
-            using (var amsi = new AmsiScanner())
-            {
-                if (!amsi.RealTimeProtectionEnabled)
-                {
-                    CustomConsole.WriteError("Ensure real-time protection is enabled");
-                    return true;
-                }
-
-                amsi.AnalyzeBytes(file);
-
-                return amsi.isMalicious();
-            }
-
-        }
     }
 }
diff --git a/....Defender/Checker/Checkers/AmsiScanner.cs → ...nderTests/Checker/Checkers/AmsiScanner.cs b/....Defender/Checker/Checkers/AmsiScanner.cs → ...nderTests/Checker/Checkers/AmsiScanner.cs
diff --git a/...ender/Checker/Checkers/DefenderScanner.cs → ...Tests/Checker/Checkers/DefenderScanner.cs b/...ender/Checker/Checkers/DefenderScanner.cs → ...Tests/Checker/Checkers/DefenderScanner.cs
@@ -148,15 +148,10 @@ public class DefenderScanResult
 
     public enum ScanResult
     {
-        [Description("No threat found")]
         NoThreatFound,
-        [Description("Threat found")]
         ThreatFound,
-        [Description("The file could not be found")]
         FileNotFound,
-        [Description("Timeout")]
         Timeout,
-        [Description("Error")]
         Error
     }
 }
diff --git a/...ts.Defender/Checker/Core/CustomConsole.cs → ...fenderTests/Checker/Core/CustomConsole.cs b/...ts.Defender/Checker/Core/CustomConsole.cs → ...fenderTests/Checker/Core/CustomConsole.cs
diff --git a/...nt.Tests.Defender/Checker/Core/Helpers.cs → ...sts/DefenderTests/Checker/Core/Helpers.cs b/...nt.Tests.Defender/Checker/Core/Helpers.cs → ...sts/DefenderTests/Checker/Core/Helpers.cs
diff --git a/...nt.Tests.Defender/Checker/Core/Scanner.cs → ...sts/DefenderTests/Checker/Core/Scanner.cs b/...nt.Tests.Defender/Checker/Core/Scanner.cs → ...sts/DefenderTests/Checker/Core/Scanner.cs
diff --git a/...Defender/Checker/PInvoke/NativeMethods.cs → ...derTests/Checker/PInvoke/NativeMethods.cs b/...Defender/Checker/PInvoke/NativeMethods.cs → ...derTests/Checker/PInvoke/NativeMethods.cs
diff --git a/...sts/Agent.Tests.Defender/DefenderTests.cs → ...gent.Tests/DefenderTests/DefenderTests.cs b/...sts/Agent.Tests.Defender/DefenderTests.cs → ...gent.Tests/DefenderTests/DefenderTests.cs
@@ -14,7 +14,7 @@ public class DefenderTests
         public void ScanFiles()
         {
             bool malicious = false;
-            string parent_dir = Directory.GetParent(Directory.GetCurrentDirectory()).Parent.Parent.Parent.FullName;
+            string parent_dir = Directory.GetParent(Directory.GetCurrentDirectory()).Parent.Parent.Parent.Parent.FullName; //How deep does the rabbit hole go?
             foreach (string file in Directory.EnumerateFiles(parent_dir, "*.dll*", SearchOption.AllDirectories))
             {
                 if (file.Contains("Agent.Tests") || file.Contains("\\obj\\")) //Windows only so this should be fine