From 985fab2d686c60ba0e241f28ceaa51a955b6ce77 Mon Sep 17 00:00:00 2001 From: PrajeetGuha Date: Sat, 17 May 2025 09:02:48 +0530 Subject: [PATCH] suricata package addition --- packages/common.vm/common.vm.nuspec | 2 +- .../common.vm/tools/vm.common/vm.common.psm1 | 4 +- packages/suricata.vm/suricata.vm.nuspec | 14 ++ .../suricata.vm/tools/chocolateyinstall.ps1 | 129 ++++++++++++++++++ .../suricata.vm/tools/chocolateyuninstall.ps1 | 7 + packages/suricata.vm/tools/rules.xml | 4 + 6 files changed, 157 insertions(+), 3 deletions(-) create mode 100644 packages/suricata.vm/suricata.vm.nuspec create mode 100644 packages/suricata.vm/tools/chocolateyinstall.ps1 create mode 100644 packages/suricata.vm/tools/chocolateyuninstall.ps1 create mode 100644 packages/suricata.vm/tools/rules.xml diff --git a/packages/common.vm/common.vm.nuspec b/packages/common.vm/common.vm.nuspec index b63a7ab20..310a998b0 100755 --- a/packages/common.vm/common.vm.nuspec +++ b/packages/common.vm/common.vm.nuspec @@ -2,7 +2,7 @@ common.vm - 0.0.0.20250509 + 0.0.0.20250517 Common libraries for VM-packages Mandiant diff --git a/packages/common.vm/tools/vm.common/vm.common.psm1 b/packages/common.vm/tools/vm.common/vm.common.psm1 index 7b640f498..ebee89191 100755 --- a/packages/common.vm/tools/vm.common/vm.common.psm1 +++ b/packages/common.vm/tools/vm.common/vm.common.psm1 @@ -81,7 +81,7 @@ function VM-Write-Log { [CmdletBinding()] Param( [Parameter(Mandatory=$true, Position=0)] - [ValidateSet("INFO","WARN","ERROR")] + [ValidateSet("INFO","WARN","ERROR","FATAL")] [String] $level, [Parameter(Mandatory=$true, Position=1)] [string] $message @@ -1834,7 +1834,7 @@ function VM-Get-MSIInstallerPathByProductName { try { # Get a list of all installed MSI products - $installedProducts = Get-CimInstance -Class Win32_Product | Where-Object { $_.Name -like $ProductName } + $installedProducts = Get-CimInstance -Class Win32_Product | Where-Object { $_.Name -match $ProductName } if (-not $installedProducts) { VM-Write-Log "WARN" "No product found with name like '$ProductName'" diff --git a/packages/suricata.vm/suricata.vm.nuspec b/packages/suricata.vm/suricata.vm.nuspec new file mode 100644 index 000000000..1c6182ea1 --- /dev/null +++ b/packages/suricata.vm/suricata.vm.nuspec @@ -0,0 +1,14 @@ + + + + suricata.vm + 7.0.10 + Open Information Security Foundation + Suricata is a network IDS, IPS and NSM engine developed by the OISF and the Suricata community. + + + + + Networking + + \ No newline at end of file diff --git a/packages/suricata.vm/tools/chocolateyinstall.ps1 b/packages/suricata.vm/tools/chocolateyinstall.ps1 new file mode 100644 index 000000000..f1c9a90b5 --- /dev/null +++ b/packages/suricata.vm/tools/chocolateyinstall.ps1 @@ -0,0 +1,129 @@ +$ErrorActionPreference = 'Stop' +Import-Module vm.common -Force -DisableNameChecking + +try{ + $toolName = 'suricata' + $category = VM-Get-Category($MyInvocation.MyCommand.Definition) + $toolDir = Join-Path ${Env:ProgramFiles} $toolName + $executablePath = Join-Path $toolDir "$toolName.exe" + $exeUrl = "https://www.openinfosecfoundation.org/download/windows/Suricata-7.0.10-1-64bit.msi" + $sha256 = "b32a6ca8a793a603a23de307c83831c874099f50bbcd2710ee8325d69a49fb44" + + $packageArgs = @{ + toolName = $toolName + category = $category + filetype = "MSI" + silentArgs = "/qn /norestart" + executablePath = $executablePath + url = $exeUrl + sha256 = $sha256 + consoleApp = $true + } + + VM-Install-With-Installer @packageArgs + + # Delete default desktop shortcut + $desktopShortcutPath = "${Env:HomeDrive}\Users\*\Desktop\$toolName*.lnk" + Remove-Item -Path $desktopShortcutPath -ErrorAction SilentlyContinue + + # Rules configuration and download + $rulesXmlPath = "$(Split-Path -parent $MyInvocation.MyCommand.Definition)/rules.xml" + $rulesXml = [xml](Get-Content $rulesXmlPath) + $rulesDir = Join-Path $toolDir "rules" -Resolve + $rules = $rulesXml.rules.rule + + # Tempdir for rules been added + # Rules are added to tempdir before been added to default rule folder as other default rules exist in default folder + # Rules filenames are needed for adding to config files + $tempToolDir = Join-Path ${Env:TEMP} "$toolName.vm" + $tempRuleDir = Join-Path $tempToolDir "rules" + + foreach ($rule in $rules) { + VM-Write-Log "INFO" "Attempting to install rule: $($rule.name)" + $filePath = Join-Path $tempToolDir ([System.IO.Path]::GetFileName($rule.url)) + + # Create rule specific temp folder + $tempRuleSpecificFolder = Join-Path $tempRuleDir $rule.name + New-Item $tempRuleSpecificFolder -ItemType Directory -Force + try{ + Invoke-WebRequest -Uri $rule.url -OutFile $filePath -ErrorAction Stop + # If the rule URL is a ZIP archive (collection of multiple rule files) + if ($filePath -like '*.zip') { + VM-Write-Log "INFO" "ZIP file detected." + Get-ChocolateyUnzip -FileFullPath $filePath -Destination $tempRuleSpecificFolder | Out-Null + + # If the rule URL is one rules file + } elseif ($filePath -like '*.rules') { + VM-Write-Log "INFO" "Rules file detected. Moving to $tempRuleSpecificFolder..." + Move-Item -Path $filePath -Destination $tempRuleSpecificFolder + + # Any other types of url resource is unsupported + } else { + throw "Unsupported file type: '$filePath'. Only .zip and .rule are allowed." + } + } catch { + VM-Write-Log "WARN" "Failed rule: $filePath. Cause: $($_.Exception.Message)" + } + } + + $allRuleFiles = Get-ChildItem -Path $tempRuleDir -Recurse -File -Filter *.rules + + $rulesConfigPath = Join-Path $toolDir "suricata.yaml" -Resolve + $rulesConfigLines = Get-Content -Path $rulesConfigPath + + # Index of the location in the yaml where `rule-files:` is specified + # Also collect all rules references in the config file + $ruleFilesIndex = $null + $rulesList = @() + for ($i = 0; $i -lt $rulesConfigLines.Count; $i++) { + $line = $rulesConfigLines[$i].Trim() + + # Set ruleFilesIndex when `rule-files:` found + if ($line -match '^rule-files:$') { + $ruleFilesIndex = $i + continue + } + + # Only when `rule-files` found, collect the rules references + if ($null -ne $ruleFilesIndex){ + + # Break rules reference search if the line does not start with '- .*' + if ($line -notmatch "- .*"){ + break + } + else{ + if ($line -match '\.rules$'){ + $cleanLine = $line.TrimStart('- ') + $rulesList += $cleanLine + } + } + } + } + + # The config file must have `rule-files:`, throw an error if not found + if ($null -eq $ruleFilesIndex) { + throw "Line with 'rule-files:' string not found in the config file." + } + + # Move all rule files in temp rule folder to the suricata rule folder + # Add rules to `suricata.yaml` + VM-Write-Log "INFO" "Moving rule-files to $rulesDir..." + foreach ($ruleFile in $allRuleFiles){ + Move-Item -Path $ruleFile.FullName -Destination $rulesDir -Force + if (-not ($rulesList -contains $ruleFile.Name)){ + $newRuleLine = " - $($ruleFile.Name)" + # Add rule to config file + $rulesConfigLines = $rulesConfigLines[0..$ruleFilesIndex] + $newRuleLine + $rulesConfigLines[($ruleFilesIndex + 1)..($rulesConfigLines.Length - 1)] + VM-Write-Log "INFO" "[+] Rule-file $($ruleFile.Name) added to $rulesDir. Added rule-file reference to config file." + } + else{ + VM-Write-Log "INFO" "[+] Rule-file $($ruleFile.Name) added to $rulesDir. Rule-file reference already exist in config file." + } + } + + # Save the updated content back to the file + $rulesConfigLines | Set-Content -Path $rulesConfigPath +} +catch{ + VM-Write-Log-Exception $_ +} \ No newline at end of file diff --git a/packages/suricata.vm/tools/chocolateyuninstall.ps1 b/packages/suricata.vm/tools/chocolateyuninstall.ps1 new file mode 100644 index 000000000..dd0f05643 --- /dev/null +++ b/packages/suricata.vm/tools/chocolateyuninstall.ps1 @@ -0,0 +1,7 @@ +$ErrorActionPreference = 'Continue' +Import-Module vm.common -Force -DisableNameChecking + +$toolName = 'suricata' +$category = VM-Get-Category($MyInvocation.MyCommand.Definition) + +VM-Uninstall-With-Uninstaller $toolName $category "MSI" "/qn /norestart" \ No newline at end of file diff --git a/packages/suricata.vm/tools/rules.xml b/packages/suricata.vm/tools/rules.xml new file mode 100644 index 000000000..bd19a9363 --- /dev/null +++ b/packages/suricata.vm/tools/rules.xml @@ -0,0 +1,4 @@ + + + + \ No newline at end of file