Update clamav-unofficial-sigs to 8.0.0

README.md

@@ -660,7 +660,7 @@ Create your `user.conf` file under `/mnt/docker/mail/clamav-unofficial-sigs` dir
 # 4. In My Accountpage, choose the ClamAV list you will download. Free subscribers only get ClamAV Basic, commercial subscribers have access to ClamAV Extended. Do not use the aggressive lists.
 # 5. In the download URL, you will see 3 parameters: receipt, product and list, enter them in the variables below.
 # malwarepatrol_receipt_code="YOUR-RECEIPT-NUMBER"
-# malwarepatrol_product_code="8"
+# malwarepatrol_product_code="32"
 # malwarepatrol_list="clamav_basic"
 # malwarepatrol_free="yes"
 
@@ -680,10 +680,6 @@ Create your `user.conf` file under `/mnt/docker/mail/clamav-unofficial-sigs` dir
 # - 6. Enter the authorization signature into the config securiteinfo_authorisation_signature: replacing YOUR-SIGNATURE-NUMBER with your authorization signature from the link
 # securiteinfo_authorisation_signature="YOUR-SIGNATURE-NUMBER"
 
-# We enable Yara rules as they are now working with Clamav releases > 0.100
-yararulesproject_enabled="yes"
-enable_yararules="yes"
-
 # We enable interserver sigs
 interserver_enabled="yes"
 

rootfs/etc/clamav-unofficial-sigs/master.conf

@@ -22,8 +22,8 @@
 # Set the appropriate ClamD user and group accounts for your system.
 # If you do not want the script to set user and group permissions on
 # files and directories, comment the next two variables.
-#clam_user="clamav"
-#clam_group="clamav"
+clam_user="clamav"
+clam_group="clamav"
 
 # If you do not want the script to change the file mode of all signature
 # database files in the ClamAV working directory to 0644 (-rw-r--r--):
@@ -77,14 +77,14 @@ log_file_name="clamav-unofficial-sigs.log"
 # 5. In the download URL, you will see 3 parameters: receipt, product and list, enter them in the variables below.
 
 malwarepatrol_receipt_code="YOUR-RECEIPT-NUMBER"
-malwarepatrol_product_code="8"
+malwarepatrol_product_code="32"
 malwarepatrol_list="clamav_basic" # clamav_basic or clamav_ext
-# if the malwarepatrol_product_code is not 8,
+# if the malwarepatrol_product_code is not 32,
 # the malwarepatrol_free is set to no (non-free)
 # set to no to enable the commercial subscription url,
 malwarepatrol_free="yes"
 malwarepatrol_db="malwarepatrol.db"
-
+malwarepatrol_whitelist_googledrive="no"
 
 # =========================
 # Malware Expert : https://www.Malware Expert
@@ -116,13 +116,15 @@ securiteinfo_premium="no"
 # ========================
 # Since the database files are dynamically created, non default values can cause banning, change with caution
 additional_update_hours="4"   # Default is 4 hours (6 downloads daily).
+ditekshen_update_hours="24"   # Default is 24 hours (1 download daily).
 interserver_update_hours="1"   # Default is 2 hours (12 downloads daily).
 linuxmalwaredetect_update_hours="6"   # Default is 6 hours (4 downloads daily).
 malwareexpert_update_hours="2"   # Default is 2 hours (12 downloads daily).
 malwarepatrol_update_hours="24"   # Default is 24 hours (1 downloads daily).
 sanesecurity_update_hours="2"   # Default is 2 hours (12 downloads daily).
 securiteinfo_premium_update_hours="1"   # Default is 1 hours (24 downloads daily).
 securiteinfo_update_hours="4"   # Default is 4 hours (6 downloads daily).
+twinclams_update_hours="24"   # Default is 24 hours (1 download daily).
 urlhaus_update_hours="1"   # Default is 1 hours (24 downloads daily).
 yararulesproject_update_hours="24"   # Default is 24 hours (1 downloads daily).
 
@@ -131,14 +133,16 @@ yararulesproject_update_hours="24"   # Default is 24 hours (1 downloads daily).
 # ========================
 # Set to no to disable an entire database, if the database is empty it will also be disabled.
 additional_enabled="yes"   # Additional Databases
+ditekshen_enabled="no"   # ditekshen/detection, disabled by default, enable to use
 interserver_enabled="yes"   # interServer
 linuxmalwaredetect_enabled="yes"   # Linux Malware Detect
 malwareexpert_enabled="yes"   # Malware Expert
 malwarepatrol_enabled="yes"   # Malware Patrol
 sanesecurity_enabled="yes"   # Sanesecurity
 securiteinfo_enabled="yes"   # SecuriteInfo
+twinclams_enabled="no"   # twinclams (Splunk/TwinWave), disabled by default, enable to use
 urlhaus_enabled="yes"   # urlhaus
-yararulesproject_enabled="yes"   # Yara-Rule Project, automatically disabled if clamav is older than 0.100 and enable_yararules is disabled
+yararulesproject_enabled="no"   # Yara-Rule Project, DEPRECATED, the upstream Yara-Rules/rules repository is unmaintained and several rules fail to load or crash modern clamav, enable at your own risk
 
 # Disabled by default
 ## Enabling this will also cause the yararulesproject to be enabled if they are det to enabled.
@@ -177,9 +181,11 @@ default_dbs_rating="MEDIUM"
 # Per Database
 # These ratings will override the global rating for the specific database
 # valid ratings: LOW | MEDIUM | HIGH | DISABLE
+#ditekshen_dbs_rating=""
 #linuxmalwaredetect_dbs_rating=""
 #sanesecurity_dbs_rating=""
 #securiteinfo_dbs_rating=""
+#twinclams_dbs_rating=""
 #urlhaus_dbs_rating=""
 #yararulesproject_dbs_rating=""
 
@@ -235,7 +241,8 @@ foxhole_all.cdb|HIGH  # See Foxhole page for more details
 foxhole_all.ndb|HIGH  # See Foxhole page for more details
 foxhole_mail.cdb|HIGH # block any mail that contains a possible dangerous attachments such as: js, jse, exe, bat, com, scr, uue, ace, pif, jar, gz, lnk, lzh.
 
-### OITC http://www.oitc.com/winnow/clamsigs/index.html
+### OITC (winnow) - upstream project is no longer maintained, the signature files
+### are still distributed via the Sanesecurity mirrors but no longer receive updates
 ### Note: the two databases winnow_phish_complete.ndb and winnow_phish_complete_url.ndb should NOT be used together.
 # LOW
 winnow_bad_cw.hdb|LOW  # md5 hashes of malware attachments acquired directly from a group of botnets
@@ -254,7 +261,8 @@ winnow_phish_complete.ndb|HIGH  # Phishing and other malicious urls and compromi
 ### Note: Yara signatures require ClamAV 0.100 or newer to work
 winnow_malware.yara|DISABLED  # Duplicated in EMAIL_Cryptowall.yar and no longer maintaned
 
-### MiscreantPunch http://malwarefor.me/about/
+### MiscreantPunch - upstream site (malwarefor.me) is dead, the signature files
+### are still distributed via the Sanesecurity mirrors but no longer receive updates
 ## MEDIUM
 MiscreantPunch099-Low.ldb|MEDIUM # ruleset contains comprehensive rules for detecting malicious or abnormal Macros, JS, HTA, HTML, XAP, JAR, SWF, and more.
 ## HIGH
@@ -271,7 +279,7 @@ bofhland_malware_attach.hdb|LOW  # Malware Hashes
 bofhland_malware_URL.ndb|LOW  # Malware URLs
 bofhland_phishing_URL.ndb|LOW  # Phishing URLs
 
-###  RockSecurity http://rooksecurity.com/
+### RookSecurity - upstream site is dead, historic Hacking Team (2015) hashes
 # LOW
 hackingteam.hsb|LOW  # Hacking Team hashes based on work by rooksecurity.com
 
@@ -315,6 +323,9 @@ spam_marketing.ndb|HIGH # Spam Marketing /  spammer blacklist
 declare -a securiteinfo_premium_dbs=( #START SECURITEINFO DATABASES
 securiteinfo.mdb|LOW # 0-day Malwares
 securiteinfo0hour.hdb|LOW # 0-Hour Malwares
+securiteinfo.pdb|LOW # Phishing signatures
+securiteinfo.wdb|LOW # Whitelist signatures
+securiteinfo.yara|LOW # Yara rules, requires clamav 0.100 or newer
 ) #END NON-FREE SECURITEINFO DATABASES
 
 # ========================
@@ -341,11 +352,11 @@ declare -a interserver_dbs=(
 ## REQUIRED, Do NOT disable
 whitelist.fp|REQUIRED  # found to be false positive malware
 # LOW
-interserver256.hdb|LOW	# 100% known malware sha256 format
+interserver256.hdb|LOW	# 100 Percent known malware sha256 format
 # MEDIUM
 interservertopline.db|MEDIUM  # inserts into files, manual cleaning HEX
 # HIGH
-shell.ldb|HIGH  # 99.9% known malware using logical signatures
+shell.ldb|HIGH  # 99.9 Percent known malware using logical signatures
 ) #END Malware Expert DATABASES
 
 # ========================
@@ -376,6 +387,27 @@ declare -a urlhaus_dbs=(
 urlhaus.ndb|LOW #  malicious URLs that are being used for malware distribution
 ) #END URLHAUS DATABASES
 
+# ========================
+# ditekshen/detection Database(s)
+# ========================
+# Native clamav signatures from the ditekshen/detection github project
+declare -a ditekshen_dbs=( #START DITEKSHEN DATABASES
+### ditekshen https://github.com/ditekshen/detection
+clamav.ldb|MEDIUM # malware detection logical signatures
+indicator_rmm.ldb|MEDIUM # detects remote monitoring and management tooling
+) #END DITEKSHEN DATABASES
+
+# ========================
+# twinclams Database(s)
+# ========================
+# ClamAV signatures from the twinwave-security/twinclams github project (Splunk)
+declare -a twinclams_dbs=( #START TWINCLAMS DATABASES
+### twinclams https://github.com/twinwave-security/twinclams
+twinwave.ign2|REQUIRED # signature whitelist, prevents false positives
+twinclams.hdb|MEDIUM # malware hashes
+twinclams.ldb|MEDIUM # malware detection logical signatures
+) #END TWINCLAMS DATABASES
+
 # ========================
 # Yara Rules Project Database(s)
 # ========================
@@ -428,7 +460,6 @@ cve_rules/CVE-2017-11882.yar|MEDIUM
 cve_rules/CVE-2018-20250.yar|MEDIUM
 cve_rules/CVE-2018-4878.yar|MEDIUM
 # Identification of malicious e-mails.
-email/bank_rule.yar|MEDIUM
 email/EMAIL_Cryptowall.yar|MEDIUM
 email/Email_fake_it_maintenance_bulletin.yar|MEDIUM
 email/Email_quota_limit_warning.yar|MEDIUM
@@ -440,21 +471,17 @@ packers/JJencode.yar|DISABLED # Causes high CPU load with email attachments (ima
 # Used with documents to find if they have been crafted to leverage malicious code.
 email/Email_generic_phishing.yar|HIGH
 maldocs/Maldoc_APT_OLE_JSRat.yar|HIGH
-maldocs/Maldoc_APT10_MenuPass.yar|HIGH
 maldocs/Maldoc_APT19_CVE-2017-0199.yar|HIGH
 maldocs/Maldoc_Contains_VBE_File.yar|HIGH
 maldocs/Maldoc_CVE_2017_11882.yar|HIGH
-maldocs/Maldoc_CVE_2017_8759.yar|HIGH
 maldocs/Maldoc_CVE-2017-0199.yar|HIGH
 maldocs/Maldoc_DDE.yar|HIGH
 maldocs/Maldoc_Dridex.yar|HIGH
-maldocs/Maldoc_hancitor_dropper.yar|HIGH
 maldocs/Maldoc_Hidden_PE_file.yar|HIGH
 maldocs/Maldoc_malrtf_ole2link.yar|HIGH
 maldocs/Maldoc_MIME_ActiveMime_b64.yar|HIGH
 maldocs/Maldoc_PDF.yar|HIGH
 maldocs/Maldoc_PowerPointMouse.yar|HIGH
-maldocs/maldoc_somerules.yar|HIGH
 maldocs/Maldoc_Suspicious_OLE_target.yar|HIGH
 maldocs/Maldoc_UserForm.yar|HIGH
 maldocs/Maldoc_VBA_macro_code.yar|HIGH
@@ -463,6 +490,10 @@ maldocs/Maldoc_Word_2007_XML_Flat_OPC.yar|HIGH
 packers/Javascript_exploit_and_obfuscation.yar|HIGH
 # DISABLED
 # NOT SUPPORTED OR CRASHING CLAMAV
+maldocs/Maldoc_CVE_2017_8759.yar|DISABLED # disabled because of issues with ClamAV see https://github.com/extremeshok/clamav-unofficial-sigs/issues/384
+maldocs/maldoc_somerules.yar|DISABLED # disabled because of issues with ClamAV see https://github.com/extremeshok/clamav-unofficial-sigs/issues/384
+maldocs/Maldoc_APT10_MenuPass.yar|DISABLED # disabled because of issues with ClamAV see https://github.com/extremeshok/clamav-unofficial-sigs/issues/384
+maldocs/Maldoc_hancitor_dropper.yar|DISABLED # disabled because of issues with ClamAV see https://github.com/extremeshok/clamav-unofficial-sigs/issues/384
 email/attachment.yar|DISABLED # detects all emails with attachments
 email/image.yar|DISABLED # detects all emails with images
 email/urls.yar|DISABLED # detects all emails with urls
@@ -639,6 +670,8 @@ malwarepatrol_dir="dbs-mbl"      # MalwarePatrol sub-directory
 pid_dir="pid"      # User defined pid sub-directory
 sanesecurity_dir="dbs-ss"        # Sanesecurity sub-directory
 securiteinfo_dir="dbs-si"        # SecuriteInfo sub-directory
+ditekshen_dir="dbs-dt"        # ditekshen sub-directory
+twinclams_dir="dbs-tc"        # twinclams sub-directory
 urlhaus_dir="dbs-uh"        # urlhaus sub-directory
 work_dir_configs="configs"   # Script configs sub-directory
 yararulesproject_dir="dbs-yara"      # Yara-Rules sub-directory
@@ -712,6 +745,8 @@ selinux_fixes="no" # Default is "no" ignore ssl errors and warnings
 #work_dir_pid="" #default: uses work_dir/pid_dir
 #work_dir_sanesecurity="" #default: uses work_dir/sanesecurity_dir
 #work_dir_securiteinfo="" #default: uses work_dir/securiteinfo_dir
+#work_dir_ditekshen="" #default: uses work_dir/ditekshen_dir
+#work_dir_twinclams="" #default: uses work_dir/twinclams_dir
 #work_dir_urlhaus="" #default: uses work_dir/urlhaus_dir
 #work_dir_work_configs="" #default: uses work_dir/work_dir_configs
 #work_dir_yararulesproject="" #default: uses work_dir/yararulesproject_dir
@@ -731,12 +766,14 @@ malwarepatrol_url="https://lists.malwarepatrol.net/cgi/getfile"
 sanesecurity_gpg_url="https://www.sanesecurity.com/publickey.gpg"
 sanesecurity_url="rsync.sanesecurity.net"
 securiteinfo_url="https://www.securiteinfo.com/get/signatures"
+ditekshen_url="https://raw.githubusercontent.com/ditekshen/detection/master/clamav"
+twinclams_url="https://raw.githubusercontent.com/twinwave-security/twinclams/master"
 urlhaus_url="https://urlhaus.abuse.ch/downloads"
 yararulesproject_url="https://raw.githubusercontent.com/Yara-Rules/rules/master"
 
 # ========================
 # DO NOT EDIT !
-config_version="97"
+config_version="100"
 
 ################################################################################
 #

rootfs/etc/clamav-unofficial-sigs/os.conf

@@ -18,7 +18,7 @@
 # Rename to os.conf to enable this file
 ################################################################################
 
-# Debian 9+ (stretch, buster)
+# Debian 9 and newer (tested up to Debian 13 trixie)
 
 clam_user="clamav"
 clam_group="clamav"
@@ -41,4 +41,9 @@ clamd_socket="/run/clamav/clamd.ctl"
 # cron runs the update through this wrapper, which sends its output to syslog
 cron_script_full_path="/usr/local/bin/clamav-unofficial-sigs-cron.sh"
 
+# URLhaus now serves its ClamAV signatures only with an abuse.ch Auth-Key (the
+# anonymous download answers 410 Gone), and the script has no setting for one.
+# Re-enable once upstream supports an Auth-Key.
+urlhaus_enabled="no"
+
 # https://eXtremeSHOK.com ######################################################