#!/usr/bin/env python
# -*- coding: utf-8 -*-

from ioc_finder import find_iocs


def test_malware_names():
    s = 'Bublik Emotet Esfury Gootkit'
    malware_names = find_iocs(s)['malware_names']
    assert len(malware_names) == 4

    s = 'Bublik Bublik'
    malware_names = find_iocs(s)['malware_names']
    assert len(malware_names) == 1


def test_tlp_labels():
    s = 'tlp amber and TLP:RED'
    iocs = find_iocs(s)
    assert len(iocs['tlp_labels']) == 2
    assert 'TLP:RED' in iocs['tlp_labels']
    assert 'TLP:AMBER' in iocs['tlp_labels']

    s = 'tlp-Amber and TLPRED TlpGreen'
    iocs = find_iocs(s)
    assert len(iocs['tlp_labels']) == 3
    assert 'TLP:RED' in iocs['tlp_labels']
    assert 'TLP:AMBER' in iocs['tlp_labels']
    assert 'TLP:GREEN' in iocs['tlp_labels']


def test_domain_parsing():
    s = "this is just a (google.com) test of example.com"
    iocs = find_iocs(s)
    assert len(iocs['domains']) == 2
    assert 'google.com' in iocs['domains']


def test_ipv4_parsing():
    s = "this is just a (1.2.3.54) test of 255.255.1.255 255.256.344.1"
    iocs = find_iocs(s)
    assert len(iocs['ipv4s']) == 2
    assert '1.2.3.54' in iocs['ipv4s']
    assert '255.255.1.255' in iocs['ipv4s']
    assert '255.256.344.1' not in iocs['ipv4s']


def test_ipv6_parsing():
    s = "2001:0db8:0000:0000:0000:ff00:0042:8329 testing 2001:db8:0:0:0:ff00:42:8329 shfaldkafsdfa 2001:db8::ff00:42:8329 asdfadfas afkj;fl ::1 kljfkadf 1:1"
    iocs = find_iocs(s)
    assert len(iocs['ipv6s']) == 4
    # TODO: the following 3 ipv6s addresses are the same representation of the same thing; I need to deduplicate these more thoroughly in the parsing function
    assert '2001:0db8:0000:0000:0000:ff00:0042:8329' in iocs['ipv6s']
    assert '2001:db8:0:0:0:ff00:42:8329' in iocs['ipv6s']
    assert '2001:db8::ff00:42:8329' in iocs['ipv6s']
    assert '::1' in iocs['ipv6s']
    assert '1:1' not in iocs['ipv6s']


def test_email_address_parsing():
    s = "test@a.com bingo@en.wikipedia.com foo@a.com'.format('a'*63 bar@b.a.com'.format('a'*63, 'a'*63 bad@test-ing.com me@2600.com john.smith(comment)@example.com (comment)john.smith@example.com \"John..Doe\"@example.com' test@[192.168.0.1]"

    iocs = find_iocs(s)
    assert len(iocs['email_addresses_complete']) == 10
    assert 'test@a.com' in iocs['email_addresses_complete']
    assert 'bingo@en.wikipedia.com' in iocs['email_addresses_complete']
    assert 'foo@a.com' in iocs['email_addresses_complete']
    assert 'bar@b.a.com' in iocs['email_addresses_complete']
    assert 'bad@test-ing.com' in iocs['email_addresses_complete']
    assert 'me@2600.com' in iocs['email_addresses_complete']
    assert 'john.smith(comment)@example.com' in iocs['email_addresses_complete']
    assert '(comment)john.smith@example.com' in iocs['email_addresses_complete']
    assert '\"John..Doe\"@example.com' in iocs['email_addresses_complete']
    assert 'test@[192.168.0.1]' in iocs['email_addresses_complete']

    iocs = find_iocs('a@example.com')
    assert iocs['email_addresses_complete'][0] == 'a@example.com'


def test_complex_email_address_parsing():
    s = 'john.smith(comment)@example.com'
    iocs = find_iocs(s)
    assert 'john.smith(comment)@example.com' in iocs['email_addresses_complete']


def test_simple_email_address_parsing():
    s = "test@a.com bingo@en.wikipedia.com foo@a.com'.format('a'*63 bar@b.a.com'.format('a'*63, 'a'*63 bad@test-ing.com me@2600.com john.smith(comment)@example.com (comment)john.smith@example.com \"John..Doe\"@example.com' test@[192.168.0.1]"

    iocs = find_iocs(s)
    assert len(iocs['email_addresses']) == 8
    assert 'test@a.com' in iocs['email_addresses']
    assert 'bingo@en.wikipedia.com' in iocs['email_addresses']
    assert 'foo@a.com' in iocs['email_addresses']
    assert 'bar@b.a.com' in iocs['email_addresses']
    assert 'bad@test-ing.com' in iocs['email_addresses']
    assert 'me@2600.com' in iocs['email_addresses']
    assert 'john.smith@example.com' in iocs['email_addresses']
    assert 'test@[192.168.0.1]' in iocs['email_addresses']

    iocs = find_iocs('a@example.com')
    assert iocs['email_addresses'][0] == 'a@example.com'


def test_url_parsing():
    invalid_urls = [
        'foo@{}.com'.format('a' * 64),
        '!@.com',
        'foo@abc',
        '@@@@-hi-.com',
        '@_hi_.com',
        'me@*hi*.com',
        'foo{}.com'.format('a' * 64),
        '.com',
        'abc',
        '-hi-.com',
        '_hi_.com',
        '*hi*.com',
    ]

    valid_urls = [
        'https://a.com',
        'https://en.wikipedia.com',
        'https://{}.com'.format('a' * 63),
        'https://{}.{}.com'.format('a' * 63, 'a' * 63),
        'https://test-ing.com',
        'https://2600.com',
        'https://example.com',
        'http://example.com',
        'ftp://example.com',
        'http://"John..Doe"@example.com',
        'http://test@a.com',
        'http://bingo@en.wikipedia.com',
        'http://foo@{}.com'.format('a' * 63),
    ]

    iocs = find_iocs(' '.join(valid_urls))
    assert len(iocs['urls']) == 13
    # make sure domains are being parsed from the valid urls as well
    assert len(iocs['domains']) == 7

    iocs = find_iocs(' '.join(invalid_urls))
    assert len(iocs['urls']) == 0

    s = 'http://8pretgdl.r.us-east-1.awstrack.me/L0/http:%2F%2Fwww.excelgoodies.com%2Fexcel-vba-training-in-virginia%23course-content/1/0100016ed23f4bef-b14931bd-26f6-4130-9c37-c4f9902a771d-000000/mHJBuJ8D1RcIDE3jrWkdw4I9im4=138'
    iocs = find_iocs(s)
    assert iocs['urls'] == [
        'http://8pretgdl.r.us-east-1.awstrack.me/L0/http:%2F%2Fwww.excelgoodies.com%2Fexcel-vba-training-in-virginia%23course-content/1/0100016ed23f4bef-b14931bd-26f6-4130-9c37-c4f9902a771d-000000/mHJBuJ8D1RcIDE3jrWkdw4I9im4=138'
    ]


def test_file_hash_parsing():
    s = "{} {} {} {} {}".format('A' * 32, 'a' * 32, 'b' * 40, 'c' * 64, 'd' * 128)
    iocs = find_iocs(s)
    assert len(iocs['md5s']) == 1
    assert len(iocs['sha1s']) == 1
    assert len(iocs['sha256s']) == 1
    assert len(iocs['sha512s']) == 1


def test_asn_parsing():
    s = "asn1234 as1234 asn 1234 as 1234 AS 4321 ASN4321"
    iocs = find_iocs(s)
    # this test works because all of the asns should be standardized into the same form
    assert len(iocs['asns']) == 2
    assert 'ASN1234' in iocs['asns']
    assert 'ASN4321' in iocs['asns']


def test_cve_parsing():
    s = "cve-2014-1000 cve 2014-1001 cve-1999-1002 CVE 2999-1003 CVE 1928-1004"
    iocs = find_iocs(s)
    assert len(iocs['cves']) == 5
    assert 'CVE-2014-1000' in iocs['cves']
    assert 'CVE-2014-1001' in iocs['cves']
    assert 'CVE-1999-1002' in iocs['cves']
    assert 'CVE-2999-1003' in iocs['cves']
    assert 'CVE-1928-1004' in iocs['cves']


def test_ipv4_cidr_parsing():
    s = "1.2.3.4/0 1.2.3.4/10 1.2.3.4/20 1.2.3.4/32"
    iocs = find_iocs(s)
    assert len(iocs['ipv4_cidrs']) == 4
    assert '1.2.3.4/0' in iocs['ipv4_cidrs']
    assert '1.2.3.4/10' in iocs['ipv4_cidrs']
    assert '1.2.3.4/20' in iocs['ipv4_cidrs']
    assert '1.2.3.4/32' in iocs['ipv4_cidrs']

    s = "1.2.3.4/0 1.2.3.4/10 1.2.3.4/20 1.2.3.4/32"
    iocs = find_iocs(s, parse_address_from_cidr=False)
    assert len(iocs['ipv4_cidrs']) == 4
    assert len(iocs['ipv4s']) == 0


def test_registry_key_parsing():
    s = "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows HKLM\Software\Microsoft\Windows HKCC\Software\Microsoft\Windows"
    iocs = find_iocs(s)
    assert len(iocs['registry_key_paths']) == 3
    assert 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows' in iocs['registry_key_paths']
    assert 'HKLM\Software\Microsoft\Windows' in iocs['registry_key_paths']
    assert 'HKCC\Software\Microsoft\Windows' in iocs['registry_key_paths']


def test_adsense_publisher_id_parsing():
    s = "pub-1234567891234567"
    iocs = find_iocs(s)
    assert len(iocs['google_adsense_publisher_ids']) == 1
    iocs['google_adsense_publisher_ids'][0] == 'pub-1234567891234567'

    s = "pub-1234567891234567 pub-9383614236930773"
    iocs = find_iocs(s)
    assert len(iocs['google_adsense_publisher_ids']) == 2
    assert 'pub-1234567891234567' in iocs['google_adsense_publisher_ids']
    assert 'pub-9383614236930773' in iocs['google_adsense_publisher_ids']


def test_analytics_publisher_id_parsing():
    s = "UA-000000-2"
    iocs = find_iocs(s)
    assert len(iocs['google_analytics_tracker_ids']) == 1
    assert iocs['google_analytics_tracker_ids'][0] == 'UA-000000-2'

    s = "UA-000000-2 UA-00000000-99"
    iocs = find_iocs(s)
    assert len(iocs['google_analytics_tracker_ids']) == 2
    assert 'UA-000000-2' in iocs['google_analytics_tracker_ids']
    assert 'UA-00000000-99' in iocs['google_analytics_tracker_ids']


def test_bitcoin_parsing():
    s = """1BvBMSEYstWetqTFn5Au4m4GFg7xJaNVN2.
P2SH type starting with the number 3, eg: 3J98t1WpEZ73CNmQviecrnyiWrnqRhWNLy.
Bech32 type starting with bc1, eg: bc1qar0srrr7xfkvy5l643lydnw9re59gtzzwf5mdq"""
    iocs = find_iocs(s)
    assert len(iocs['bitcoin_addresses']) == 3
    assert '1BvBMSEYstWetqTFn5Au4m4GFg7xJaNVN2' in iocs['bitcoin_addresses']
    assert '3J98t1WpEZ73CNmQviecrnyiWrnqRhWNLy' in iocs['bitcoin_addresses']
    assert 'bc1qar0srrr7xfkvy5l643lydnw9re59gtzzwf5mdq' in iocs['bitcoin_addresses']


def test_xmpp_address_parsing():
    s = """foo@swissjabber.de bar@jabber.zone bom@jabber.sow.as me@example.com"""
    iocs = find_iocs(s)
    assert len(iocs['xmpp_addresses']) == 3
    assert 'foo@swissjabber.de' in iocs['xmpp_addresses']
    assert 'bar@jabber.zone' in iocs['xmpp_addresses']
    assert 'bom@jabber.sow.as' in iocs['xmpp_addresses']
    assert len(iocs['domains']) == 4
    # make sure the xmpp addresses are not also parsed as email addresses
    assert len(iocs['email_addresses']) == 1

    iocs = find_iocs(s, parse_domain_name_from_xmpp_address=False)
    assert len(iocs['xmpp_addresses']) == 3
    assert 'foo@swissjabber.de' in iocs['xmpp_addresses']
    assert 'bar@jabber.zone' in iocs['xmpp_addresses']
    assert 'bom@jabber.sow.as' in iocs['xmpp_addresses']
    assert len(iocs['domains']) == 1
    # make sure the xmpp addresses are not also parsed as email addresses
    assert len(iocs['email_addresses']) == 1


def test_mac_address_parsing():
    s = 'AA-F2-C9-A6-B3-4F AB:F2:C9:A6:B3:4F ACF2.C9A6.B34F'

    iocs = find_iocs(s)
    assert len(iocs['mac_addresses']) == 3
    assert 'AA-F2-C9-A6-B3-4F' in iocs['mac_addresses']
    assert 'AB:F2:C9:A6:B3:4F' in iocs['mac_addresses']
    assert 'ACF2.C9A6.B34F' in iocs['mac_addresses']

    # same thing, just lower-case
    s = 'aa-f2-c9-a6-b3-4f ab:f2:c9:a6:b3:4f acf2.c9a6.b34f'
    iocs = find_iocs(s)
    assert len(iocs['mac_addresses']) == 3
    assert 'aa-f2-c9-a6-b3-4f' in iocs['mac_addresses']
    assert 'ab:f2:c9:a6:b3:4f' in iocs['mac_addresses']
    assert 'acf2.c9a6.b34f' in iocs['mac_addresses']


def test_ssdeep_parsing():
    s = "1536:yB+A8bMtMeRlbIzvDqZL4QzNxVDm+5gt+M2hDDDvNZ3YZ7sU:N4tMsbOGcyrV6BQvnoZ4U"
    iocs = find_iocs(s)
    assert len(iocs['ssdeeps']) == 1
    assert iocs['ssdeeps'][0] == '1536:yB+A8bMtMeRlbIzvDqZL4QzNxVDm+5gt+M2hDDDvNZ3YZ7sU:N4tMsbOGcyrV6BQvnoZ4U'

    s = "ahdfadsfa 1536:yB+A8bMtMeRlbIzvDqZL4QzNxVDm+5gt+M2hDDDvNZ3YZ7sU:N4tMsbOGcyrV6BQvnoZ4U,000/000/000000001 adfasf"
    iocs = find_iocs(s)
    assert len(iocs['ssdeeps']) == 1
    assert iocs['ssdeeps'][0] == '1536:yB+A8bMtMeRlbIzvDqZL4QzNxVDm+5gt+M2hDDDvNZ3YZ7sU:N4tMsbOGcyrV6BQvnoZ4U'

    s = """c2b257868686c861d43c6cf3de146b8812778c8283f7d
Threat  Zepakab/Zebrocy Downloader
ssdeep  12288:QYV6MorX7qzuC3QHO9FQVHPF51jgcSj2EtPo/V7I6R+Lqaw8i6hG0:vBXu9HGaVHh4Po/VU6RkqaQ6F"""
    iocs = find_iocs(s)
    assert len(iocs['ssdeeps']) == 1
    assert iocs['ssdeeps'][0] == '12288:QYV6MorX7qzuC3QHO9FQVHPF51jgcSj2EtPo/V7I6R+Lqaw8i6hG0:vBXu9HGaVHh4Po/VU6RkqaQ6F'

    s = """393216:EW/eKCo9QgoHfHYebwoyC0QStQYEb+G8j3wfVOglnimQyCK+mteYREDWXKF2b:MKg3lbwoyCnCkNHlnimfCSQx8b,"000/000/000000001"
196608:AGSE26mYSK0iwH8HW9TDl0vnvCZwZEkzzeap7R:Ak28siwH8eRSn25k3eg,"000/000/000000002"
98304:O1OCzezOgr4XMP7Af0+Kh7MzplFKuu5XcS9QnCD/VWR6yf4OB6S/mwRTwjf0ih87:k/Y4XMT7YguEXqCD/VWR6yf4Ux/mwR0S,"000/000/000000003"
96:ukILJhn54RewghSib4xGEHVLFNs+4tihJW6jJenUQrsIvpMMjUg:uk0Jx54usxJHh4gJrJenUQrs2pvIg,"000/000/000000004"
196608:rNI4QlKQbWQobu0u3QRBBibfv+Z4Hjy5M+IjunAadLLtt42fAtQSqFhx:rNkK2obu0uBb3K4H28yAGc4RSax,"000/000/000000005"
1536:mFbhArcCMbR0S/kjzU6El4mUIR2JPmvY3lpKa38fTXcTns+b3tfZyCLtRs:obNCMbWpU6SzFAPV3lpCjCsQRZyQt6,"000/000/000000006"
48:CScrEd3jk5BsRSFCWfVsEWABbbpnWSgSX45dc6b5Qla9A+o5R6k7CyNRD5J:XcrEdzHRSFr9sE7XnsDe1CyNRNJ,"000/000/000000007"
24:N8Rw5AF4REesFtPP6k216xoWya1oxOKHHwa8peRK8FdigZY5tODrRRK8RfMfde8:N8Rw5AF4+XPyooa2EKnwaGeRJFYpfwzQ,"000/000/000000008"
1536:yB+A8bMtMeRlbIzvDqZL4QzNxVDm+5gt+M2hDDDvNZ3YZ7sU:N4tMsbOGcyrV6BQvnoZ4U,"000/000/000000009"""
    iocs = find_iocs(s)
    assert len(iocs['ssdeeps']) == 9
    assert (
        '393216:EW/eKCo9QgoHfHYebwoyC0QStQYEb+G8j3wfVOglnimQyCK+mteYREDWXKF2b:MKg3lbwoyCnCkNHlnimfCSQx8b'
        in iocs['ssdeeps']
    )
    assert '196608:AGSE26mYSK0iwH8HW9TDl0vnvCZwZEkzzeap7R:Ak28siwH8eRSn25k3eg' in iocs['ssdeeps']
    assert (
        '98304:O1OCzezOgr4XMP7Af0+Kh7MzplFKuu5XcS9QnCD/VWR6yf4OB6S/mwRTwjf0ih87:k/Y4XMT7YguEXqCD/VWR6yf4Ux/mwR0S'
        in iocs['ssdeeps']
    )
    assert '96:ukILJhn54RewghSib4xGEHVLFNs+4tihJW6jJenUQrsIvpMMjUg:uk0Jx54usxJHh4gJrJenUQrs2pvIg' in iocs['ssdeeps']
    assert (
        '196608:rNI4QlKQbWQobu0u3QRBBibfv+Z4Hjy5M+IjunAadLLtt42fAtQSqFhx:rNkK2obu0uBb3K4H28yAGc4RSax' in iocs['ssdeeps']
    )
    assert (
        '1536:mFbhArcCMbR0S/kjzU6El4mUIR2JPmvY3lpKa38fTXcTns+b3tfZyCLtRs:obNCMbWpU6SzFAPV3lpCjCsQRZyQt6'
        in iocs['ssdeeps']
    )
    assert (
        '48:CScrEd3jk5BsRSFCWfVsEWABbbpnWSgSX45dc6b5Qla9A+o5R6k7CyNRD5J:XcrEdzHRSFr9sE7XnsDe1CyNRNJ' in iocs['ssdeeps']
    )
    assert (
        '24:N8Rw5AF4REesFtPP6k216xoWya1oxOKHHwa8peRK8FdigZY5tODrRRK8RfMfde8:N8Rw5AF4+XPyooa2EKnwaGeRJFYpfwzQ'
        in iocs['ssdeeps']
    )
    assert '1536:yB+A8bMtMeRlbIzvDqZL4QzNxVDm+5gt+M2hDDDvNZ3YZ7sU:N4tMsbOGcyrV6BQvnoZ4U' in iocs['ssdeeps']


def test_imphash_parsing():
    names = ['imphash', 'import hash']
    templates = [
        """SHA-256 093e394933c4545ba7019f511961b9a5ab91156cf791f45de074acad03d1a44a
Dropper {}: 18ddf28a71089acdbab5038f58044c0a
C2 IP: 210.209.127.8:443""",
        '{}: 18ddf28a71089acdbab5038f58044c0a',
        '{} 18ddf28a71089acdbab5038f58044c0a',
        '{}  18ddf28a71089acdbab5038f58044c0a',
        '{}:     18ddf28a71089acdbab5038f58044c0a',
        '{}\t18ddf28a71089acdbab5038f58044c0a',
        '{}\n18ddf28a71089acdbab5038f58044c0a',
        '{} - 18ddf28a71089acdbab5038f58044c0a',
    ]

    for template in templates:
        for name in names:
            print(template)
            iocs = find_iocs(template.format(name))
            assert len(iocs['imphashes']) == 1
            assert iocs['imphashes'] == ['18ddf28a71089acdbab5038f58044c0a']
            assert len(iocs['md5s']) == 0

            iocs = find_iocs(template.format(name.upper()))
            assert len(iocs['imphashes']) == 1
            assert iocs['imphashes'] == ['18ddf28a71089acdbab5038f58044c0a']
            assert len(iocs['md5s']) == 0


def test_authentihash():
    names = ['authentihash']
    templates = [
        '{} 3f1b149d07e7e8636636b8b7f7043c40ed64a10b28986181fb046c498432c2d4',
        '{}   3f1b149d07e7e8636636b8b7f7043c40ed64a10b28986181fb046c498432c2d4',
        '{}: 3f1b149d07e7e8636636b8b7f7043c40ed64a10b28986181fb046c498432c2d4',
        '{}:     3f1b149d07e7e8636636b8b7f7043c40ed64a10b28986181fb046c498432c2d4',
        '{} - 3f1b149d07e7e8636636b8b7f7043c40ed64a10b28986181fb046c498432c2d4',
        '{}-3f1b149d07e7e8636636b8b7f7043c40ed64a10b28986181fb046c498432c2d4',
        '{}\t3f1b149d07e7e8636636b8b7f7043c40ed64a10b28986181fb046c498432c2d4',
        '{}\n3f1b149d07e7e8636636b8b7f7043c40ed64a10b28986181fb046c498432c2d4',
    ]

    for template in templates:
        for name in names:
            print(template)
            iocs = find_iocs(template.format(name))
            assert len(iocs['authentihashes']) == 1
            assert iocs['authentihashes'] == ['3f1b149d07e7e8636636b8b7f7043c40ed64a10b28986181fb046c498432c2d4']
            assert len(iocs['sha256s']) == 0

            iocs = find_iocs(template.format(name.upper()))
            assert len(iocs['authentihashes']) == 1
            assert iocs['authentihashes'] == ['3f1b149d07e7e8636636b8b7f7043c40ed64a10b28986181fb046c498432c2d4']
            assert len(iocs['sha256s']) == 0


def test_user_agents():
    s = 'Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1; .NET CLR 1.1.4322; InfoPath.1)'
    iocs = find_iocs(s)
    assert len(iocs['user_agents']) == 1
    assert iocs['user_agents'] == ['Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1; .NET CLR 1.1.4322; InfoPath.1)']

    s = 'mozilla/5.0 (windows nt 6.1; wow64) applewebkit/535.11 (khtml, like gecko) chrome/17.0.963.56 safari/535.11 mozilla/5.0 (windows nt 6.1; wow64; rv:11.0) gecko firefox/11.0'
    iocs = find_iocs(s)
    assert len(iocs['user_agents']) == 2
    assert (
        'mozilla/5.0 (windows nt 6.1; wow64) applewebkit/535.11 (khtml, like gecko) chrome/17.0.963.56 safari/535.11'
        in iocs['user_agents']
    )
    assert 'mozilla/5.0 (windows nt 6.1; wow64; rv:11.0) gecko firefox/11.0' in iocs['user_agents']

    # test the same thing as above but with different casing to make sure the cases are matched and maintained properly
    s = 'Mozilla/5.0 (Windows nt 6.1; wow64) Applewebkit/535.11 (khtml, like Gecko) Chrome/17.0.963.56 Safari/535.11 Mozilla/5.0 (Windows nt 6.1; wow64; rv:11.0) Gecko Firefox/11.0'
    iocs = find_iocs(s)
    assert len(iocs['user_agents']) == 2
    assert (
        'Mozilla/5.0 (Windows nt 6.1; wow64) Applewebkit/535.11 (khtml, like Gecko) Chrome/17.0.963.56 Safari/535.11'
        in iocs['user_agents']
    )
    assert 'Mozilla/5.0 (Windows nt 6.1; wow64; rv:11.0) Gecko Firefox/11.0' in iocs['user_agents']


def test_file_paths():
    s = r"""C:\Users\<username>\AppData \Local\Microsoft\Windows\shedaudio.exe

C:\Users\<username>\AppData\Roaming\Macromedia\Flash Player\macromedia\bin\flashplayer.exe

Typical Registry Keys:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

System Root Directories:

C:\Windows\11987416.exe

C:\Windows\System32\46615275.exe

C:\Windows\System32\shedaudio.exe

C:\Windows\SysWOW64\f9jwqSbS.exe"""
    iocs = find_iocs(s)
    assert len(iocs['file_paths']) == 6
    assert r'C:\Users\<username>\AppData \Local\Microsoft\Windows\shedaudio.exe' in iocs['file_paths']
    assert (
        r'C:\Users\<username>\AppData\Roaming\Macromedia\Flash Player\macromedia\bin\flashplayer.exe'
        in iocs['file_paths']
    )
    assert r'C:\Windows\11987416.exe' in iocs['file_paths']
    assert r'C:\Windows\System32\46615275.exe' in iocs['file_paths']
    assert r'C:\Windows\System32\shedaudio.exe' in iocs['file_paths']
    assert r'C:\Windows\SysWOW64\f9jwqSbS.exe' in iocs['file_paths']

    s = 'test /Library/Storage/File System/HFS/25cf5d02-e50b-4288-870a-528d56c3cf6e/pivtoken.appex file'
    iocs = find_iocs(s)
    assert len(iocs['file_paths']) == 1
    assert '/Library/Storage/File System/HFS/25cf5d02-e50b-4288-870a-528d56c3cf6e/pivtoken.appex' in iocs['file_paths']

    s = '~/Desktop/test.py'
    iocs = find_iocs(s)
    assert len(iocs['file_paths']) == 1
    assert '~/Desktop/test.py' in iocs['file_paths']

    s = '/etc/init.d/.rebootime'
    iocs = find_iocs(s)
    assert len(iocs['file_paths']) == 1
    assert '/etc/init.d/.rebootime' in iocs['file_paths']


def test_phone_numbers():
    phone_number_blocks = [['123', '4567'], ['123', '456', '7890'], ['(123)', '456', '7890']]

    block_connectors = ['-', ' - ', '.', ' . ', ' ']

    for block in phone_number_blocks:
        for connector in block_connectors:
            phone_number = connector.join(block)
            print(phone_number)
            iocs = find_iocs(phone_number)
            assert len(iocs['phone_numbers']) == 1
            assert iocs['phone_numbers'][0] == phone_number


def test_attack_techniques():
    s = """
ID  Name    Description
T1329   Acquire and/or use 3rd party infrastructure services    
A wide variety of cloud, virtual private services, hosting, compute, and storage solutions are available. Additionally botnets are available for rent or purchase. Use of these solutions allow an adversary to stage, launch, and execute an attack from infrastructure that does not physically tie back to them and can be rapidly provisioned, modified, and shut down.

T1307   Acquire and/or use 3rd party infrastructure services    
A wide variety of cloud, virtual private services, hosting, compute, and storage solutions are available. Additionally botnets are available for rent or purchase. Use of these solutions allow an adversary to stage, launch, and execute an attack from infrastructure that does not physically tie back to them and can be rapidly provisioned, modified, and shut down.

T1308"""
    results = find_iocs(s)
    assert len(results['attack_techniques']) == 3
    assert 'T1329' in results['attack_techniques']
    assert 'T1307' in results['attack_techniques']
    assert 'T1308' in results['attack_techniques']


def test_attack_tactics():
    s = """
    ID  Name    Description
    TA0012  Priority Definition Planning    Priority definition planning consists of the process of determining the set of Key Intelligence Topics (KIT) or Key Intelligence Questions (KIQ) required for meeting key strategic, operational, or tactical goals. Leadership outlines the priority definition (may be considered a goal) around which the adversary designs target selection and a plan to achieve. An analyst may outline the priority definition when in the course of determining gaps in existing KITs or KIQs.
    TA0013  Priority Definition Direction   Priority definition direction consists of the process of collecting and assigning requirements for meeting Key Intelligence Topics (KIT) or Key Intelligence Questions (KIQ) as determined by leadership.
    TA0014  Targ"""
    results = find_iocs(s)
    assert len(results['attack_tactics']) == 3
    assert 'TA0012' in results['attack_tactics']
    assert 'TA0013' in results['attack_tactics']
    assert 'TA0014' in results['attack_tactics']
