integrate nsacyber/ELITEWOLF signatures into default rule set

[mmguero]

NSA cyber's ELITEWOLF project releases some OT-focused Snort rules. I'd like to:

• review these rules
• convert from Snort to Suricata (see https://docs.suricata.io/en/latest/rules/differences-from-snort.html)
• test them
• include them as part of Malcolm's default rule set

[IdahoManny]

Converted and Tested Snort to Suricata

Suricata does have compatibility with snort rules. The files below were taken from the repository and tested with Suricata. Change file names from .txt to .rules file and place in /etc/suricata/rules/path. Sample log file is also attached. Test of rules were conducted with netcat.

Tested-ELITEWOLF_SNORT_AllenBradley_RockwellAutomation.txt
Tested-ELITEWOLF_SNORT_SchweitzerEngineeringLaboratories.txt
Tested-ELITEWOLF_SNORT_Siemens.txt
logs.txt

[mmguero]

see mmguero-dev/Malcolm@baebc49

suricata container build logs indicating that the rules have been included:

...
11 40.26 14/11/2023 -- 15:49:34 - <Info> -- Loading local file /etc/suricata/rules/stream-events.rules
#11 40.26 14/11/2023 -- 15:49:34 - <Info> -- Loading local file /etc/suricata/rules/tls-events.rules
#11 40.26 14/11/2023 -- 15:49:34 - <Info> -- Loading local file /etc/suricata/rules/AllenBradley_RockwellAutomation.rules
#11 40.26 14/11/2023 -- 15:49:34 - <Info> -- Loading local file /etc/suricata/rules/SchweitzerEngineeringLaboratories.rules
#11 40.26 14/11/2023 -- 15:49:34 - <Info> -- Loading local file /etc/suricata/rules/Siemens.rules
#11 40.26 14/11/2023 -- 15:49:34 - <Info> -- Loading local file /etc/suricata/rules/app-layer-events.rules
...
#11 40.26 14/11/2023 -- 15:49:34 - <Info> -- Loading local file /etc/suricata/rules/tls-events.rules
#11 40.26 14/11/2023 -- 15:49:34 - <Info> -- Loading local file /etc/suricata/rules/AllenBradley_RockwellAutomation.rules
#11 40.26 14/11/2023 -- 15:49:34 - <Info> -- Loading local file /etc/suricata/rules/SchweitzerEngineeringLaboratories.rules
#11 40.26 14/11/2023 -- 15:49:34 - <Info> -- Loading local file /etc/suricata/rules/Siemens.rules
#11 40.26 14/11/2023 -- 15:49:34 - <Info> -- Loading distribution rule file /etc/suricata/rules/app-layer-events.rules
...
#11 40.26 14/11/2023 -- 15:49:34 - <Debug> -- Parsing /etc/suricata/rules/AllenBradley_RockwellAutomation.rules
#11 40.26 14/11/2023 -- 15:49:34 - <Debug> -- Parsing /etc/suricata/rules/AllenBradley_RockwellAutomation.rules
#11 40.26 14/11/2023 -- 15:49:34 - <Debug> -- Parsing /etc/suricata/rules/SchweitzerEngineeringLaboratories.rules
#11 40.26 14/11/2023 -- 15:49:34 - <Debug> -- Parsing /etc/suricata/rules/SchweitzerEngineeringLaboratories.rules
#11 40.27 14/11/2023 -- 15:49:34 - <Debug> -- Parsing /etc/suricata/rules/Siemens.rules
#11 40.27 14/11/2023 -- 15:49:34 - <Debug> -- Parsing /etc/suricata/rules/Siemens.rules
...

From what I can tell they are in place and loaded correctly. I don't have PCAPs to verify but suricata confirms the rules are there.