Adding upstream version 1.3.2.upstream/1.3.2

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

3 files changed, 529 insertions, 0 deletions

diff --git a/suricata/update/data/__init__.py b/suricata/update/data/__init__.py
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/suricata/update/data/__init__.py
diff --git a/suricata/update/data/index.py b/suricata/update/data/index.py
new file mode 100644
index 0000000..02a9c4f
--- /dev/null
+++ b/suricata/update/data/index.py
@@ -0,0 +1,476 @@
+index = {   'sources': {   'et/open': {   'description': 'Proofpoint ET Open is a '
+                                                 'timely and accurate rule set '
+                                                 'for detecting and blocking '
+                                                 'advanced threats\n',
+                                  'license': 'MIT',
+                                  'summary': 'Emerging Threats Open Ruleset',
+                                  'url': 'https://rules.emergingthreats.net/open/suricata-%(__version__)s/emerging.rules.tar.gz',
+                                  'vendor': 'Proofpoint'},
+                   'et/pro': {   'checksum': False,
+                                 'description': 'Proofpoint ET Pro is a timely '
+                                                'and accurate rule set for '
+                                                'detecting and blocking '
+                                                'advanced threats\n',
+                                 'license': 'Commercial',
+                                 'parameters': {   'secret-code': {   'prompt': 'Emerging '
+                                                                                'Threats '
+                                                                                'Pro '
+                                                                                'access '
+                                                                                'code'}},
+                                 'replaces': ['et/open'],
+                                 'subscribe-url': 'https://www.proofpoint.com/us/threat-insight/et-pro-ruleset',
+                                 'summary': 'Emerging Threats Pro Ruleset',
+                                 'url': 'https://rules.emergingthreatspro.com/%(secret-code)s/suricata-%(__version__)s/etpro.rules.tar.gz',
+                                 'vendor': 'Proofpoint'},
+                   'etnetera/aggressive': {   'checksum': False,
+                                              'license': 'MIT',
+                                              'min-version': '4.0.0',
+                                              'summary': 'Etnetera aggressive '
+                                                         'IP blacklist',
+                                              'url': 'https://security.etnetera.cz/feeds/etn_aggressive.rules',
+                                              'vendor': 'Etnetera a.s.'},
+                   'malsilo/win-malware': {   'checksum': True,
+                                              'description': 'TCP/UDP, DNS and '
+                                                             'HTTP Windows '
+                                                             'threats '
+                                                             'artifacts '
+                                                             'observed at '
+                                                             'runtime.\n',
+                                              'homepage': 'https://raw-data.gitlab.io/post/malsilo_2.1/',
+                                              'license': 'MIT',
+                                              'min-version': '4.1.0',
+                                              'summary': 'Commodity malware '
+                                                         'rules',
+                                              'url': 'https://malsilo.gitlab.io/feeds/dumps/malsilo.rules.tar.gz',
+                                              'vendor': 'malsilo'},
+                   'oisf/trafficid': {   'checksum': False,
+                                         'license': 'MIT',
+                                         'min-version': '4.0.0',
+                                         'summary': 'Suricata Traffic ID '
+                                                    'ruleset',
+                                         'support-url': 'https://redmine.openinfosecfoundation.org/',
+                                         'url': 'https://openinfosecfoundation.org/rules/trafficid/trafficid.rules',
+                                         'vendor': 'OISF'},
+                   'pawpatrules': {   'checksum': False,
+                                      'description': 'PAW Patrules ruleset '
+                                                     'permit to detect many '
+                                                     'events on\n'
+                                                     'network. Suspicious '
+                                                     'flow, malicious tool, '
+                                                     'unsuported and\n'
+                                                     'vulnerable system, known '
+                                                     'threat actors with '
+                                                     'various IOCs,\n'
+                                                     'lateral movement, bad '
+                                                     'practice, shadow IT... '
+                                                     'Rules are\n'
+                                                     'frequently updated.\n',
+                                      'homepage': 'https://pawpatrules.fr/',
+                                      'license': 'CC-BY-SA-4.0',
+                                      'min-version': '6.0.0',
+                                      'summary': 'PAW Patrules is a collection '
+                                                 'of rules for IDPS / NSM '
+                                                 'Suricata engine',
+                                      'url': 'https://rules.pawpatrules.fr/suricata/paw-patrules.tar.gz',
+                                      'vendor': 'pawpatrules'},
+                   'ptresearch/attackdetection': {   'description': 'The '
+                                                                    'Attack '
+                                                                    'Detection '
+                                                                    'Team '
+                                                                    'searches '
+                                                                    'for new '
+                                                                    'vulnerabilities '
+                                                                    'and '
+                                                                    '0-days, '
+                                                                    'reproduces '
+                                                                    'it and '
+                                                                    'creates '
+                                                                    'PoC '
+                                                                    'exploits '
+                                                                    'to '
+                                                                    'understand '
+                                                                    'how these '
+                                                                    'security '
+                                                                    'flaws '
+                                                                    'work and '
+                                                                    'how '
+                                                                    'related '
+                                                                    'attacks '
+                                                                    'can be '
+                                                                    'detected '
+                                                                    'on the '
+                                                                    'network '
+                                                                    'layer. '
+                                                                    'Additionally, '
+                                                                    'we are '
+                                                                    'interested '
+                                                                    'in '
+                                                                    'malware '
+                                                                    'and '
+                                                                    "hackers' "
+                                                                    'TTPs, so '
+                                                                    'we '
+                                                                    'develop '
+                                                                    'Suricata '
+                                                                    'rules for '
+                                                                    'detecting '
+                                                                    'all sorts '
+                                                                    'of such '
+                                                                    'activities.\n',
+                                                     'license': 'Custom',
+                                                     'license-url': 'https://raw.githubusercontent.com/ptresearch/AttackDetection/master/LICENSE',
+                                                     'obsolete': 'no longer '
+                                                                 'exists',
+                                                     'summary': 'Positive '
+                                                                'Technologies '
+                                                                'Attack '
+                                                                'Detection '
+                                                                'Team ruleset',
+                                                     'url': 'https://raw.githubusercontent.com/ptresearch/AttackDetection/master/pt.rules.tar.gz',
+                                                     'vendor': 'Positive '
+                                                               'Technologies'},
+                   'scwx/enhanced': {   'description': 'Broad ruleset composed '
+                                                       'of malware rules and '
+                                                       'other security-related '
+                                                       'countermeasures, and '
+                                                       'curated by the '
+                                                       'Secureworks Counter '
+                                                       'Threat Unit research '
+                                                       'team.  This ruleset '
+                                                       'has been enhanced with '
+                                                       'comprehensive and '
+                                                       'fully '
+                                                       'standard-compliant '
+                                                       'BETTER metadata '
+                                                       '(https://better-schema.readthedocs.io/).\n',
+                                        'license': 'Commercial',
+                                        'min-version': '3.0.0',
+                                        'parameters': {   'secret-code': {   'prompt': 'Secureworks '
+                                                                                       'Threat '
+                                                                                       'Intelligence '
+                                                                                       'Authentication '
+                                                                                       'Token'}},
+                                        'subscribe-url': 'https://www.secureworks.com/contact/ '
+                                                         '(Please reference '
+                                                         'CTU Countermeasures)',
+                                        'summary': 'Secureworks '
+                                                   'suricata-enhanced ruleset',
+                                        'url': 'https://ws.secureworks.com/ti/ruleset/%(secret-code)s/Suricata_suricata-enhanced_latest.tgz',
+                                        'vendor': 'Secureworks'},
+                   'scwx/malware': {   'description': 'High-fidelity, '
+                                                      'high-priority ruleset '
+                                                      'composed mainly of '
+                                                      'malware-related '
+                                                      'countermeasures and '
+                                                      'curated by the '
+                                                      'Secureworks Counter '
+                                                      'Threat Unit research '
+                                                      'team.\n',
+                                       'license': 'Commercial',
+                                       'min-version': '3.0.0',
+                                       'parameters': {   'secret-code': {   'prompt': 'Secureworks '
+                                                                                      'Threat '
+                                                                                      'Intelligence '
+                                                                                      'Authentication '
+                                                                                      'Token'}},
+                                       'subscribe-url': 'https://www.secureworks.com/contact/ '
+                                                        '(Please reference CTU '
+                                                        'Countermeasures)',
+                                       'summary': 'Secureworks '
+                                                  'suricata-malware ruleset',
+                                       'url': 'https://ws.secureworks.com/ti/ruleset/%(secret-code)s/Suricata_suricata-malware_latest.tgz',
+                                       'vendor': 'Secureworks'},
+                   'scwx/security': {   'description': 'Broad ruleset composed '
+                                                       'of malware rules and '
+                                                       'other security-related '
+                                                       'countermeasures, and '
+                                                       'curated by the '
+                                                       'Secureworks Counter '
+                                                       'Threat Unit research '
+                                                       'team.\n',
+                                        'license': 'Commercial',
+                                        'min-version': '3.0.0',
+                                        'parameters': {   'secret-code': {   'prompt': 'Secureworks '
+                                                                                       'Threat '
+                                                                                       'Intelligence '
+                                                                                       'Authentication '
+                                                                                       'Token'}},
+                                        'subscribe-url': 'https://www.secureworks.com/contact/ '
+                                                         '(Please reference '
+                                                         'CTU Countermeasures)',
+                                        'summary': 'Secureworks '
+                                                   'suricata-security ruleset',
+                                        'url': 'https://ws.secureworks.com/ti/ruleset/%(secret-code)s/Suricata_suricata-security_latest.tgz',
+                                        'vendor': 'Secureworks'},
+                   'sslbl/ja3-fingerprints': {   'checksum': False,
+                                                 'description': 'If you are '
+                                                                'running '
+                                                                'Suricata, you '
+                                                                'can use the '
+                                                                "SSLBL's "
+                                                                'Suricata JA3 '
+                                                                'FingerprintRuleset '
+                                                                'to detect '
+                                                                'and/or block '
+                                                                'malicious SSL '
+                                                                'connections '
+                                                                'in your '
+                                                                'network based '
+                                                                'on the JA3 '
+                                                                'fingerprint. '
+                                                                'Please note '
+                                                                'that your '
+                                                                'need Suricata '
+                                                                '4.1.0 or '
+                                                                'newer in '
+                                                                'order to use '
+                                                                'the JA3 '
+                                                                'fingerprint '
+                                                                'ruleset.\n',
+                                                 'license': 'Non-Commercial',
+                                                 'min-version': '4.1.0',
+                                                 'summary': 'Abuse.ch Suricata '
+                                                            'JA3 Fingerprint '
+                                                            'Ruleset',
+                                                 'url': 'https://sslbl.abuse.ch/blacklist/ja3_fingerprints.rules',
+                                                 'vendor': 'Abuse.ch'},
+                   'sslbl/ssl-fp-blacklist': {   'checksum': False,
+                                                 'description': 'The SSL '
+                                                                'Blacklist '
+                                                                '(SSLBL) is a '
+                                                                'project of '
+                                                                'abuse.ch with '
+                                                                'the goal of '
+                                                                'detecting '
+                                                                'malicious SSL '
+                                                                'connections, '
+                                                                'by '
+                                                                'identifying '
+                                                                'and '
+                                                                'blacklisting '
+                                                                'SSL '
+                                                                'certificates '
+                                                                'used by '
+                                                                'botnet C&C '
+                                                                'servers. In '
+                                                                'addition, '
+                                                                'SSLBL '
+                                                                'identifies '
+                                                                'JA3 '
+                                                                'fingerprints '
+                                                                'that helps '
+                                                                'you to detect '
+                                                                '& block '
+                                                                'malware '
+                                                                'botnet C&C '
+                                                                'communication '
+                                                                'on the TCP '
+                                                                'layer.\n',
+                                                 'license': 'Non-Commercial',
+                                                 'summary': 'Abuse.ch SSL '
+                                                            'Blacklist',
+                                                 'url': 'https://sslbl.abuse.ch/blacklist/sslblacklist.rules',
+                                                 'vendor': 'Abuse.ch'},
+                   'stamus/lateral': {   'description': 'Suricata ruleset '
+                                                        'specifically focused '
+                                                        'on detecting lateral\n'
+                                                        'movement in Microsoft '
+                                                        'Windows environments '
+                                                        'by Stamus Networks\n',
+                                         'license': 'GPL-3.0-only',
+                                         'min-version': '6.0.6',
+                                         'summary': 'Lateral movement rules',
+                                         'support-url': 'https://discord.com/channels/911231224448712714/911238451842666546',
+                                         'url': 'https://ti.stamus-networks.io/open/stamus-lateral-rules.tar.gz',
+                                         'vendor': 'Stamus Networks'},
+                   'stamus/nrd-14-open': {   'description': 'Newly Registered '
+                                                            'Domains list '
+                                                            '(last 14 days) to '
+                                                            'match on DNS, TLS '
+                                                            'and HTTP '
+                                                            'communication.\n'
+                                                            'Produced by '
+                                                            'Stamus Labs '
+                                                            'research team.\n',
+                                             'license': 'Commercial',
+                                             'min-version': '6.0.0',
+                                             'parameters': {   'secret-code': {   'prompt': 'Stamus '
+                                                                                            'Networks '
+                                                                                            'License '
+                                                                                            'code'}},
+                                             'subscribe-url': 'https://www.stamus-networks.com/stamus-labs/subscribe-to-threat-intel-feed',
+                                             'summary': 'Newly Registered '
+                                                        'Domains Open only - '
+                                                        '14 day list, complete',
+                                             'url': 'https://ti.stamus-networks.io/%(secret-code)s/sti-domains-nrd-14.tar.gz',
+                                             'vendor': 'Stamus Networks'},
+                   'stamus/nrd-30-open': {   'description': 'Newly Registered '
+                                                            'Domains list '
+                                                            '(last 30 days) to '
+                                                            'match on DNS, TLS '
+                                                            'and HTTP '
+                                                            'communication.\n'
+                                                            'Produced by '
+                                                            'Stamus Labs '
+                                                            'research team.\n',
+                                             'license': 'Commercial',
+                                             'min-version': '6.0.0',
+                                             'parameters': {   'secret-code': {   'prompt': 'Stamus '
+                                                                                            'Networks '
+                                                                                            'License '
+                                                                                            'code'}},
+                                             'subscribe-url': 'https://www.stamus-networks.com/stamus-labs/subscribe-to-threat-intel-feed',
+                                             'summary': 'Newly Registered '
+                                                        'Domains Open only - '
+                                                        '30 day list, complete',
+                                             'url': 'https://ti.stamus-networks.io/%(secret-code)s/sti-domains-nrd-30.tar.gz',
+                                             'vendor': 'Stamus Networks'},
+                   'stamus/nrd-entropy-14-open': {   'description': 'Suspicious '
+                                                                    'Newly '
+                                                                    'Registered '
+                                                                    'Domains '
+                                                                    'list with '
+                                                                    'high '
+                                                                    'entropy '
+                                                                    '(last 14 '
+                                                                    'days) to '
+                                                                    'match on '
+                                                                    'DNS, TLS '
+                                                                    'and HTTP '
+                                                                    'communication.\n'
+                                                                    'Produced '
+                                                                    'by Stamus '
+                                                                    'Labs '
+                                                                    'research '
+                                                                    'team.\n',
+                                                     'license': 'Commercial',
+                                                     'min-version': '6.0.0',
+                                                     'parameters': {   'secret-code': {   'prompt': 'Stamus '
+                                                                                                    'Networks '
+                                                                                                    'License '
+                                                                                                    'code'}},
+                                                     'subscribe-url': 'https://www.stamus-networks.com/stamus-labs/subscribe-to-threat-intel-feed',
+                                                     'summary': 'Newly '
+                                                                'Registered '
+                                                                'Domains Open '
+                                                                'only - 14 day '
+                                                                'list, high '
+                                                                'entropy',
+                                                     'url': 'https://ti.stamus-networks.io/%(secret-code)s/sti-domains-entropy-14.tar.gz',
+                                                     'vendor': 'Stamus '
+                                                               'Networks'},
+                   'stamus/nrd-entropy-30-open': {   'description': 'Suspicious '
+                                                                    'Newly '
+                                                                    'Registered '
+                                                                    'Domains '
+                                                                    'list with '
+                                                                    'high '
+                                                                    'entropy '
+                                                                    '(last 30 '
+                                                                    'days) to '
+                                                                    'match on '
+                                                                    'DNS, TLS '
+                                                                    'and HTTP '
+                                                                    'communication.\n'
+                                                                    'Produced '
+                                                                    'by Stamus '
+                                                                    'Labs '
+                                                                    'research '
+                                                                    'team.\n',
+                                                     'license': 'Commercial',
+                                                     'min-version': '6.0.0',
+                                                     'parameters': {   'secret-code': {   'prompt': 'Stamus '
+                                                                                                    'Networks '
+                                                                                                    'License '
+                                                                                                    'code'}},
+                                                     'subscribe-url': 'https://www.stamus-networks.com/stamus-labs/subscribe-to-threat-intel-feed',
+                                                     'summary': 'Newly '
+                                                                'Registered '
+                                                                'Domains Open '
+                                                                'only - 30 day '
+                                                                'list, high '
+                                                                'entropy',
+                                                     'url': 'https://ti.stamus-networks.io/%(secret-code)s/sti-domains-entropy-30.tar.gz',
+                                                     'vendor': 'Stamus '
+                                                               'Networks'},
+                   'stamus/nrd-phishing-14-open': {   'description': 'Suspicious '
+                                                                     'Newly '
+                                                                     'Registered '
+                                                                     'Domains '
+                                                                     'Phishing '
+                                                                     'list '
+                                                                     '(last 14 '
+                                                                     'days) to '
+                                                                     'match on '
+                                                                     'DNS, TLS '
+                                                                     'and HTTP '
+                                                                     'communication.\n'
+                                                                     'Produced '
+                                                                     'by '
+                                                                     'Stamus '
+                                                                     'Labs '
+                                                                     'research '
+                                                                     'team.\n',
+                                                      'license': 'Commercial',
+                                                      'min-version': '6.0.0',
+                                                      'parameters': {   'secret-code': {   'prompt': 'Stamus '
+                                                                                                     'Networks '
+                                                                                                     'License '
+                                                                                                     'code'}},
+                                                      'subscribe-url': 'https://www.stamus-networks.com/stamus-labs/subscribe-to-threat-intel-feed',
+                                                      'summary': 'Newly '
+                                                                 'Registered '
+                                                                 'Domains Open '
+                                                                 'only - 14 '
+                                                                 'day list, '
+                                                                 'phishing',
+                                                      'url': 'https://ti.stamus-networks.io/%(secret-code)s/sti-domains-phishing-14.tar.gz',
+                                                      'vendor': 'Stamus '
+                                                                'Networks'},
+                   'stamus/nrd-phishing-30-open': {   'description': 'Suspicious '
+                                                                     'Newly '
+                                                                     'Registered '
+                                                                     'Domains '
+                                                                     'Phishing '
+                                                                     'list '
+                                                                     '(last 30 '
+                                                                     'days) to '
+                                                                     'match on '
+                                                                     'DNS, TLS '
+                                                                     'and HTTP '
+                                                                     'communication.\n'
+                                                                     'Produced '
+                                                                     'by '
+                                                                     'Stamus '
+                                                                     'Labs '
+                                                                     'research '
+                                                                     'team.\n',
+                                                      'license': 'Commercial',
+                                                      'min-version': '6.0.0',
+                                                      'parameters': {   'secret-code': {   'prompt': 'Stamus '
+                                                                                                     'Networks '
+                                                                                                     'License '
+                                                                                                     'code'}},
+                                                      'subscribe-url': 'https://www.stamus-networks.com/stamus-labs/subscribe-to-threat-intel-feed',
+                                                      'summary': 'Newly '
+                                                                 'Registered '
+                                                                 'Domains Open '
+                                                                 'only - 30 '
+                                                                 'day list, '
+                                                                 'phishing',
+                                                      'url': 'https://ti.stamus-networks.io/%(secret-code)s/sti-domains-phishing-30.tar.gz',
+                                                      'vendor': 'Stamus '
+                                                                'Networks'},
+                   'tgreen/hunting': {   'checksum': False,
+                                         'description': 'Heuristic ruleset for '
+                                                        'hunting. Focus on '
+                                                        'anomaly detection and '
+                                                        'showcasing latest '
+                                                        'engine features, not '
+                                                        'performance.\n',
+                                         'license': 'GPLv3',
+                                         'min-version': '4.1.0',
+                                         'summary': 'Threat hunting rules',
+                                         'url': 'https://raw.githubusercontent.com/travisbgreen/hunting-rules/master/hunting.rules',
+                                         'vendor': 'tgreen'}},
+    'version': 1}
\ No newline at end of file
diff --git a/suricata/update/data/update.py b/suricata/update/data/update.py
new file mode 100644
index 0000000..8b34c40
--- /dev/null
+++ b/suricata/update/data/update.py
@@ -0,0 +1,53 @@
+# Copyright (C) 2018-2022 Open Information Security Foundation
+#
+# You can copy, redistribute or modify this Program under the terms of
+# the GNU General Public License version 2 as published by the Free
+# Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# version 2 along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+# 02110-1301, USA.
+
+import os.path
+import sys
+import pprint
+
+try:
+    from urllib2 import urlopen
+except:
+    from urllib.request import urlopen
+
+import yaml
+
+DEFAULT_URL = "https://raw.githubusercontent.com/oisf/suricata-intel-index/master/index.yaml"
+
+def embed_index():
+    """Embed a copy of the index as a Python source file. We can't use a
+    datafile yet as there is no easy way to do with distutils."""
+    if len(sys.argv) > 1:
+        url = sys.argv[1]
+    else:
+        url = DEFAULT_URL
+    dist_filename = os.path.join(os.path.dirname(__file__), "index.py")
+    response = urlopen(url)
+    index = yaml.safe_load(response.read())
+
+    # Delete the version info to prevent the issue of the version info being out of
+    # date around a new release of Suricata where the index has not been updated
+    # to the latest recommended version.  The user will be asked to update their
+    # sources to run the version check.
+    del(index["versions"])
+
+    pp = pprint.PrettyPrinter(indent=4)
+
+    with open(dist_filename, "w") as fileobj:
+        fileobj.write("index = {}".format(pp.pformat(index)))
+    
+if __name__ == "__main__":
+    embed_index()