Adds indicators for android properties

tests/android_androidqf/test_getprop.py

@@ -7,6 +7,7 @@ import logging
 import os
 
 from mvt.android.modules.androidqf.getprop import Getprop
+from mvt.common.indicators import Indicators
 from mvt.common.module import run_module
 
 from ..utils import get_artifact_folder
@@ -18,5 +19,18 @@ class TestAndroidqfGetpropAnalysis:
         m = Getprop(target_path=os.path.join(get_artifact_folder(), "androidqf"), log=logging)
         run_module(m)
         assert len(m.results) == 10
+        assert m.results[0]["name"] == "dalvik.vm.appimageformat"
+        assert m.results[0]["value"] == "lz4"
         assert len(m.timeline) == 0
         assert len(m.detected) == 0
+
+    def test_androidqf_getprop_detection(self, indicator_file):
+        m = Getprop(target_path=os.path.join(get_artifact_folder(), "androidqf"), log=logging)
+        ind = Indicators(log=logging.getLogger())
+        ind.parse_stix2(indicator_file)
+        ind.ioc_collections[0]["android_property_names"].append("dalvik.vm.heapmaxfree")
+        m.indicators = ind
+        run_module(m)
+        assert len(m.results) == 10
+        assert len(m.detected) == 1
+        assert m.detected[0]["name"] == "dalvik.vm.heapmaxfree"

tests/artifacts/generate_stix.py

@@ -16,6 +16,7 @@ def generate_test_stix_file(file_path):
     processes = ["Launch"]
     emails = ["foobar@example.org"]
     filenames = ["/var/foobar/txt"]
+    android_property = ["sys.foobar"]
 
     res = []
     malware = Malware(name="TestMalware", is_family=False, description="")
@@ -40,6 +41,11 @@ def generate_test_stix_file(file_path):
         res.append(i)
         res.append(Relationship(i, "indicates", malware))
 
+    for p in android_property:
+        i = Indicator(indicator_types=["malicious-activity"], pattern="[android-property:name='{}']".format(p), pattern_type="stix")
+        res.append(i)
+        res.append(Relationship(i, "indicates", malware))
+
     bundle = Bundle(objects=res)
     with open(file_path, "w+", encoding="utf-8") as f:
         f.write(bundle.serialize(pretty=True))

tests/common/test_indicators.py

@@ -14,11 +14,12 @@ class TestIndicators:
     def test_parse_stix2(self, indicator_file):
         ind = Indicators(log=logging)
         ind.load_indicators_files([indicator_file], load_default=False)
-        assert ind.ioc_collections[0]["count"] == 4
+        assert ind.ioc_collections[0]["count"] == 5
         assert len(ind.ioc_collections[0]["domains"]) == 1
         assert len(ind.ioc_collections[0]["emails"]) == 1
         assert len(ind.ioc_collections[0]["file_names"]) == 1
         assert len(ind.ioc_collections[0]["processes"]) == 1
+        assert len(ind.ioc_collections[0]["android_property_names"]) == 1
 
     def test_check_domain(self, indicator_file):
         ind = Indicators(log=logging)
@@ -26,8 +27,14 @@ class TestIndicators:
         assert ind.check_domain("https://www.example.org/foobar")
         assert ind.check_domain("http://example.org:8080/toto")
 
+    def test_check_android_property(self, indicator_file):
+        ind = Indicators(log=logging)
+        ind.load_indicators_files([indicator_file], load_default=False)
+        assert ind.check_android_property_name("sys.foobar")
+        assert ind.check_android_property_name("sys.soundsokay") is None
+
     def test_env_stix(self, indicator_file):
         os.environ["MVT_STIX2"] = indicator_file
         ind = Indicators(log=logging)
         ind.load_indicators_files([], load_default=False)
-        assert ind.total_ioc_count == 4
+        assert ind.total_ioc_count == 5