From 11080bd627096c733b7a6fbd522d669dd756f04c Mon Sep 17 00:00:00 2001 From: kitos Date: Tue, 14 Jul 2026 17:24:14 +0200 Subject: [PATCH] fix(tests): recognize sysmon, wevtutil, auditpol as detection commands MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Blue's detect_procedure extraction had zero Blue-team-oriented tool names in its known-binaries list — sysmon.exe, one of the most common Windows detection tools, silently produced no suggestion at all. Verified against the exact production input that surfaced this. --- backend/app/services/procedure_extraction_service.py | 4 +++- backend/tests/test_procedure_extraction_service.py | 12 ++++++++++++ 2 files changed, 15 insertions(+), 1 deletion(-) diff --git a/backend/app/services/procedure_extraction_service.py b/backend/app/services/procedure_extraction_service.py index c6ee344..1068832 100644 --- a/backend/app/services/procedure_extraction_service.py +++ b/backend/app/services/procedure_extraction_service.py @@ -48,7 +48,9 @@ _COMMAND_LINE_RE = re.compile( netsh|wmic|schtasks|sc|rundll32|regsvr32|msiexec|certutil| mimikatz\S*|cscript|wscript|osascript|openssl|systemctl|service| reg\s+query|whoami|nslookup|dig|ping|tasklist|ps\s|kill| - Invoke-\S+|iex|dsquery|nltest)\b + Invoke-\S+|iex|dsquery|nltest| + sysmon\S*|wevtutil|auditpol|tcpdump|tshark|procmon\S*|autorunsc\S*| + volatility\S*)\b | \bSELECT\s+.+\s+FROM\b # SQL | diff --git a/backend/tests/test_procedure_extraction_service.py b/backend/tests/test_procedure_extraction_service.py index acef726..b4ac522 100644 --- a/backend/tests/test_procedure_extraction_service.py +++ b/backend/tests/test_procedure_extraction_service.py @@ -95,3 +95,15 @@ def test_known_binary_at_start_of_line_is_recognized(): text = "Notes: used the following.\nsudo tcpdump -i eth0 -w capture.pcap\nCaptured 500 packets." result = extract_commands(text) assert result == "sudo tcpdump -i eth0 -w capture.pcap" + + +def test_recognizes_sysmon_as_a_detection_command(): + text = "launch sysmon to detect\nsysmon.exe\nthen search this query\n\\? mimikatz \\n" + result = extract_commands(text) + assert result == "sysmon.exe" + + +def test_recognizes_wevtutil_and_auditpol(): + text = "Pulled the security log.\nwevtutil qe Security /c:5\nThen checked audit policy.\nauditpol /get /category:*" + result = extract_commands(text) + assert result == "wevtutil qe Security /c:5\nauditpol /get /category:*"