Would you use a Antiphishing Suricata ruleset developed under an open-source software license?
For over a year, I have been working on a ruleset that was born with the goal of offering free resources and popularizing Suricata with features that are usually locked behind paid private licenses.
I started the project by mapping phishing vectors through public APIs and synthesizing them into Suricata rules.
*Note: Don't know what Suricata is? It's what used to be called a network antivirus; nowadays, it's called a Network Intrusion Detection System (IDS). This explanation doesn't cover everything, but it's enough to understand my point here. If you're unfamiliar, I suggest looking it up.*
I took these vectors and separated them into four types of rules: TLS, HTTP, DNS, and more recently, IP (though the IP rule is still under observation since blocking IPs is a massive responsibility).
After doing that, I handled all the management work, avoiding duplicates, and so on. This past month, thanks to a tip here on Reddit, I integrated NRD (Newly Registered Domains). It checks for typosquatting and similarities to detect suspicious links—for example, banc0dobrasil.com.br and so on.
I implemented this using a well-known library for this specific feature and registered several major companies based on the analysis of already collected vectors.
Now, the ruleset is already integrated with suricata-update, OPNsense, and has several users.
I wanted to invite the users here to test it out as well.
Ultimately, I think this is a great project for anyone who wants to contribute, or use the data to produce threat intelligence reports and the like. Furthermore, the project includes a web dashboard where you can search for vectors and SIDs (the rule ID for the vector).
The dashboard is just as important: it aggregates all mapped vectors and provides data such as GeoIP, Whois, DNS tests, last-seen records, and in some cases, endpoint analysis (I'll explain why only "in some cases" in a moment). The project also features a free API for potential integrations.
I've been working in the industry for over 10 years and wanted to create something impactful for this powerful tool (Suricata). Open-source is something grand, and I'm very happy to have achieved this. I use my free time to work on this project; it updates automatically and sometimes manually, but consistently 3 times a day.
To explain why some data points don't always work—which is the same reason it doesn't update even more frequently—I have zero funding. I host everything using GitHub Pages and developed it all from scratch, but the APIs have rate limits because, ideally, you're supposed to pay for a license. Despite everything, it has been working, but it has the potential for many improvements and industrial-scale features.
In the end, I think this project makes the most sense for those who work in the field. Here is my invitation: anyone who wants to use, read, edit, contribute, or even donate is very welcome. That way, the project will move forward much faster. Who knows, maybe one day I can leave everything else behind and live off this project, and help other professionals do the same? A dream.
I felt safe opening up here. Long live open-source software!
