Add MalSilo GitLab threat intelligence feeds

Added complete MalSilo threat intelligence feed collection including:
- IPv4, URL, domain feeds for malware threat indicators
- Suricata IDS/IPS rules for DNS, IP, and URL detection
- MalSilo maintainer and Suricata syntax entries
- Generated EF Core migration for database schema updates

Covers all feeds mentioned in issue #3253 with proper categorization,
metadata, and relationships according to FilterLists data model.

Co-authored-by: collinbarrett <6483057+collinbarrett@users.noreply.github.com>
This commit is contained in:
copilot-swe-agent[bot] 2025-07-30 00:21:34 +00:00 committed by Collin Barrett
parent fe4acc0aea
commit 230b377a91
10 changed files with 91203 additions and 0 deletions

View file

@ -0,0 +1,255 @@
using Microsoft.EntityFrameworkCore.Migrations;
#nullable disable
#pragma warning disable CA1814 // Prefer jagged arrays over multidimensional
namespace FilterLists.Directory.Infrastructure.Migrations.Migrations
{
/// <inheritdoc />
public partial class AddMalSiloFilterLists : Migration
{
/// <inheritdoc />
protected override void Up(MigrationBuilder migrationBuilder)
{
migrationBuilder.InsertData(
table: "FilterList",
columns: new[] { "Id", "ChatUrl", "Description", "DonateUrl", "EmailAddress", "ForumUrl", "HomeUrl", "IssuesUrl", "LicenseId", "Name", "OnionUrl", "PolicyUrl", "SubmissionUrl" },
values: new object[,]
{
{ 2806, null, "MalSilo threat intelligence feed containing malicious IPv4 addresses with threat categorization and metadata. This feed provides IP addresses associated with various malware families and threat actors.", null, null, null, "https://malsilo.gitlab.io/feeds/", null, 5, "MalSilo IPv4 Feed", null, null, null },
{ 2807, null, "MalSilo threat intelligence feed containing malicious URLs with threat categorization and metadata. This feed provides URLs associated with various malware families and threat actors.", null, null, null, "https://malsilo.gitlab.io/feeds/", null, 5, "MalSilo URL Feed", null, null, null },
{ 2808, null, "MalSilo threat intelligence feed containing malicious domains with threat categorization and metadata. This feed provides domains associated with various malware families and threat actors.", null, null, null, "https://malsilo.gitlab.io/feeds/", null, 5, "MalSilo Domain Feed", null, null, null },
{ 2809, null, "MalSilo Suricata DNS detection rules for identifying and blocking malicious DNS queries. These rules are designed for use with Suricata IDS/IPS systems.", null, null, null, "https://malsilo.gitlab.io/feeds/", null, 5, "MalSilo DNS Rules", null, null, null },
{ 2810, null, "MalSilo Suricata IP detection rules for identifying and blocking malicious IP traffic. These rules are designed for use with Suricata IDS/IPS systems.", null, null, null, "https://malsilo.gitlab.io/feeds/", null, 5, "MalSilo IP Rules", null, null, null },
{ 2811, null, "MalSilo Suricata URL detection rules for identifying and blocking malicious URL traffic. These rules are designed for use with Suricata IDS/IPS systems.", null, null, null, "https://malsilo.gitlab.io/feeds/", null, 5, "MalSilo URL Rules", null, null, null }
});
migrationBuilder.InsertData(
table: "Maintainer",
columns: new[] { "Id", "EmailAddress", "Name", "TwitterHandle", "Url" },
values: new object[] { 205, "malsilo@tuta.io", "MalSilo", null, "https://malsilo.gitlab.io/feeds/" });
migrationBuilder.InsertData(
table: "Syntax",
columns: new[] { "Id", "Description", "Name", "Url" },
values: new object[] { (short)58, null, "Suricata", "https://suricata.io/documentation/" });
migrationBuilder.InsertData(
table: "FilterListMaintainer",
columns: new[] { "FilterListId", "MaintainerId" },
values: new object[,]
{
{ 2806, 205 },
{ 2807, 205 },
{ 2808, 205 },
{ 2809, 205 },
{ 2810, 205 },
{ 2811, 205 }
});
migrationBuilder.InsertData(
table: "FilterListSyntax",
columns: new[] { "FilterListId", "SyntaxId" },
values: new object[,]
{
{ 2806, (short)9 },
{ 2807, (short)2 },
{ 2808, (short)2 },
{ 2809, (short)48 },
{ 2810, (short)48 },
{ 2811, (short)48 }
});
migrationBuilder.InsertData(
table: "FilterListTag",
columns: new[] { "FilterListId", "TagId" },
values: new object[,]
{
{ 2806, 6 },
{ 2807, 6 },
{ 2808, 6 },
{ 2809, 6 },
{ 2810, 6 },
{ 2811, 6 }
});
migrationBuilder.InsertData(
table: "FilterListViewUrl",
columns: new[] { "FilterListId", "Id", "Primariness", "Url" },
values: new object[,]
{
{ 2806, 3193, (short)1, "https://malsilo.gitlab.io/feeds/dumps/ip_list.txt" },
{ 2807, 3194, (short)1, "https://malsilo.gitlab.io/feeds/dumps/url_list.txt" },
{ 2808, 3195, (short)1, "https://malsilo.gitlab.io/feeds/dumps/domain_list.txt" },
{ 2809, 3196, (short)1, "https://malsilo.gitlab.io/feeds/dumps/malsilo-dns.rules" },
{ 2810, 3197, (short)1, "https://malsilo.gitlab.io/feeds/dumps/malsilo-ip.rules" },
{ 2811, 3198, (short)1, "https://malsilo.gitlab.io/feeds/dumps/malsilo-url.rules" }
});
}
/// <inheritdoc />
protected override void Down(MigrationBuilder migrationBuilder)
{
migrationBuilder.DeleteData(
table: "FilterListMaintainer",
keyColumns: new[] { "FilterListId", "MaintainerId" },
keyValues: new object[] { 2806, 205 });
migrationBuilder.DeleteData(
table: "FilterListMaintainer",
keyColumns: new[] { "FilterListId", "MaintainerId" },
keyValues: new object[] { 2807, 205 });
migrationBuilder.DeleteData(
table: "FilterListMaintainer",
keyColumns: new[] { "FilterListId", "MaintainerId" },
keyValues: new object[] { 2808, 205 });
migrationBuilder.DeleteData(
table: "FilterListMaintainer",
keyColumns: new[] { "FilterListId", "MaintainerId" },
keyValues: new object[] { 2809, 205 });
migrationBuilder.DeleteData(
table: "FilterListMaintainer",
keyColumns: new[] { "FilterListId", "MaintainerId" },
keyValues: new object[] { 2810, 205 });
migrationBuilder.DeleteData(
table: "FilterListMaintainer",
keyColumns: new[] { "FilterListId", "MaintainerId" },
keyValues: new object[] { 2811, 205 });
migrationBuilder.DeleteData(
table: "FilterListSyntax",
keyColumns: new[] { "FilterListId", "SyntaxId" },
keyValues: new object[] { 2806, (short)9 });
migrationBuilder.DeleteData(
table: "FilterListSyntax",
keyColumns: new[] { "FilterListId", "SyntaxId" },
keyValues: new object[] { 2807, (short)2 });
migrationBuilder.DeleteData(
table: "FilterListSyntax",
keyColumns: new[] { "FilterListId", "SyntaxId" },
keyValues: new object[] { 2808, (short)2 });
migrationBuilder.DeleteData(
table: "FilterListSyntax",
keyColumns: new[] { "FilterListId", "SyntaxId" },
keyValues: new object[] { 2809, (short)48 });
migrationBuilder.DeleteData(
table: "FilterListSyntax",
keyColumns: new[] { "FilterListId", "SyntaxId" },
keyValues: new object[] { 2810, (short)48 });
migrationBuilder.DeleteData(
table: "FilterListSyntax",
keyColumns: new[] { "FilterListId", "SyntaxId" },
keyValues: new object[] { 2811, (short)48 });
migrationBuilder.DeleteData(
table: "FilterListTag",
keyColumns: new[] { "FilterListId", "TagId" },
keyValues: new object[] { 2806, 6 });
migrationBuilder.DeleteData(
table: "FilterListTag",
keyColumns: new[] { "FilterListId", "TagId" },
keyValues: new object[] { 2807, 6 });
migrationBuilder.DeleteData(
table: "FilterListTag",
keyColumns: new[] { "FilterListId", "TagId" },
keyValues: new object[] { 2808, 6 });
migrationBuilder.DeleteData(
table: "FilterListTag",
keyColumns: new[] { "FilterListId", "TagId" },
keyValues: new object[] { 2809, 6 });
migrationBuilder.DeleteData(
table: "FilterListTag",
keyColumns: new[] { "FilterListId", "TagId" },
keyValues: new object[] { 2810, 6 });
migrationBuilder.DeleteData(
table: "FilterListTag",
keyColumns: new[] { "FilterListId", "TagId" },
keyValues: new object[] { 2811, 6 });
migrationBuilder.DeleteData(
table: "FilterListViewUrl",
keyColumns: new[] { "FilterListId", "Id" },
keyValues: new object[] { 2806, 3193 });
migrationBuilder.DeleteData(
table: "FilterListViewUrl",
keyColumns: new[] { "FilterListId", "Id" },
keyValues: new object[] { 2807, 3194 });
migrationBuilder.DeleteData(
table: "FilterListViewUrl",
keyColumns: new[] { "FilterListId", "Id" },
keyValues: new object[] { 2808, 3195 });
migrationBuilder.DeleteData(
table: "FilterListViewUrl",
keyColumns: new[] { "FilterListId", "Id" },
keyValues: new object[] { 2809, 3196 });
migrationBuilder.DeleteData(
table: "FilterListViewUrl",
keyColumns: new[] { "FilterListId", "Id" },
keyValues: new object[] { 2810, 3197 });
migrationBuilder.DeleteData(
table: "FilterListViewUrl",
keyColumns: new[] { "FilterListId", "Id" },
keyValues: new object[] { 2811, 3198 });
migrationBuilder.DeleteData(
table: "Syntax",
keyColumn: "Id",
keyValue: (short)58);
migrationBuilder.DeleteData(
table: "FilterList",
keyColumn: "Id",
keyValue: 2806);
migrationBuilder.DeleteData(
table: "FilterList",
keyColumn: "Id",
keyValue: 2807);
migrationBuilder.DeleteData(
table: "FilterList",
keyColumn: "Id",
keyValue: 2808);
migrationBuilder.DeleteData(
table: "FilterList",
keyColumn: "Id",
keyValue: 2809);
migrationBuilder.DeleteData(
table: "FilterList",
keyColumn: "Id",
keyValue: 2810);
migrationBuilder.DeleteData(
table: "FilterList",
keyColumn: "Id",
keyValue: 2811);
migrationBuilder.DeleteData(
table: "Maintainer",
keyColumn: "Id",
keyValue: 205);
}
}
}

View file

@ -20908,6 +20908,54 @@ protected override void BuildModel(ModelBuilder modelBuilder)
IssuesUrl = "https://github.com/ShadowWhisperer/IPs/issues",
LicenseId = 7,
Name = "ShadowWhisperer - Other Tunnel"
},
new
{
Id = 2806,
Description = "MalSilo threat intelligence feed containing malicious IPv4 addresses with threat categorization and metadata. This feed provides IP addresses associated with various malware families and threat actors.",
HomeUrl = "https://malsilo.gitlab.io/feeds/",
LicenseId = 5,
Name = "MalSilo IPv4 Feed"
},
new
{
Id = 2807,
Description = "MalSilo threat intelligence feed containing malicious URLs with threat categorization and metadata. This feed provides URLs associated with various malware families and threat actors.",
HomeUrl = "https://malsilo.gitlab.io/feeds/",
LicenseId = 5,
Name = "MalSilo URL Feed"
},
new
{
Id = 2808,
Description = "MalSilo threat intelligence feed containing malicious domains with threat categorization and metadata. This feed provides domains associated with various malware families and threat actors.",
HomeUrl = "https://malsilo.gitlab.io/feeds/",
LicenseId = 5,
Name = "MalSilo Domain Feed"
},
new
{
Id = 2809,
Description = "MalSilo Suricata DNS detection rules for identifying and blocking malicious DNS queries. These rules are designed for use with Suricata IDS/IPS systems.",
HomeUrl = "https://malsilo.gitlab.io/feeds/",
LicenseId = 5,
Name = "MalSilo DNS Rules"
},
new
{
Id = 2810,
Description = "MalSilo Suricata IP detection rules for identifying and blocking malicious IP traffic. These rules are designed for use with Suricata IDS/IPS systems.",
HomeUrl = "https://malsilo.gitlab.io/feeds/",
LicenseId = 5,
Name = "MalSilo IP Rules"
},
new
{
Id = 2811,
Description = "MalSilo Suricata URL detection rules for identifying and blocking malicious URL traffic. These rules are designed for use with Suricata IDS/IPS systems.",
HomeUrl = "https://malsilo.gitlab.io/feeds/",
LicenseId = 5,
Name = "MalSilo URL Rules"
});
});
@ -33287,6 +33335,36 @@ protected override void BuildModel(ModelBuilder modelBuilder)
{
FilterListId = 2805,
MaintainerId = 204
},
new
{
FilterListId = 2806,
MaintainerId = 205
},
new
{
FilterListId = 2807,
MaintainerId = 205
},
new
{
FilterListId = 2808,
MaintainerId = 205
},
new
{
FilterListId = 2809,
MaintainerId = 205
},
new
{
FilterListId = 2810,
MaintainerId = 205
},
new
{
FilterListId = 2811,
MaintainerId = 205
});
});
@ -44884,6 +44962,36 @@ protected override void BuildModel(ModelBuilder modelBuilder)
{
FilterListId = 2805,
SyntaxId = (short)9
},
new
{
FilterListId = 2806,
SyntaxId = (short)9
},
new
{
FilterListId = 2807,
SyntaxId = (short)2
},
new
{
FilterListId = 2808,
SyntaxId = (short)2
},
new
{
FilterListId = 2809,
SyntaxId = (short)48
},
new
{
FilterListId = 2810,
SyntaxId = (short)48
},
new
{
FilterListId = 2811,
SyntaxId = (short)48
});
});
@ -61486,6 +61594,36 @@ protected override void BuildModel(ModelBuilder modelBuilder)
{
FilterListId = 2805,
TagId = 12
},
new
{
FilterListId = 2806,
TagId = 6
},
new
{
FilterListId = 2807,
TagId = 6
},
new
{
FilterListId = 2808,
TagId = 6
},
new
{
FilterListId = 2809,
TagId = 6
},
new
{
FilterListId = 2810,
TagId = 6
},
new
{
FilterListId = 2811,
TagId = 6
});
});
@ -64394,6 +64532,13 @@ protected override void BuildModel(ModelBuilder modelBuilder)
Id = 204,
Name = "ShadowWhisperer",
Url = "https://github.com/ShadowWhisperer"
},
new
{
Id = 205,
EmailAddress = "malsilo@tuta.io",
Name = "MalSilo",
Url = "https://malsilo.gitlab.io/feeds/"
});
});
@ -66445,6 +66590,12 @@ protected override void BuildModel(ModelBuilder modelBuilder)
Id = (short)57,
Name = "CSV",
Url = "https://en.wikipedia.org/wiki/Comma-separated_values"
},
new
{
Id = (short)58,
Name = "Suricata",
Url = "https://suricata.io/documentation/"
});
});
@ -90185,6 +90336,54 @@ protected override void BuildModel(ModelBuilder modelBuilder)
Primariness = (short)1,
SegmentNumber = (short)0,
Url = "https://raw.githubusercontent.com/ShadowWhisperer/IPs/master/Other/Tunnel"
},
new
{
FilterListId = 2806,
Id = 3193,
Primariness = (short)1,
SegmentNumber = (short)0,
Url = "https://malsilo.gitlab.io/feeds/dumps/ip_list.txt"
},
new
{
FilterListId = 2807,
Id = 3194,
Primariness = (short)1,
SegmentNumber = (short)0,
Url = "https://malsilo.gitlab.io/feeds/dumps/url_list.txt"
},
new
{
FilterListId = 2808,
Id = 3195,
Primariness = (short)1,
SegmentNumber = (short)0,
Url = "https://malsilo.gitlab.io/feeds/dumps/domain_list.txt"
},
new
{
FilterListId = 2809,
Id = 3196,
Primariness = (short)1,
SegmentNumber = (short)0,
Url = "https://malsilo.gitlab.io/feeds/dumps/malsilo-dns.rules"
},
new
{
FilterListId = 2810,
Id = 3197,
Primariness = (short)1,
SegmentNumber = (short)0,
Url = "https://malsilo.gitlab.io/feeds/dumps/malsilo-ip.rules"
},
new
{
FilterListId = 2811,
Id = 3198,
Primariness = (short)1,
SegmentNumber = (short)0,
Url = "https://malsilo.gitlab.io/feeds/dumps/malsilo-url.rules"
});
});

View file

@ -18479,5 +18479,47 @@
"issuesUrl": "https://github.com/ShadowWhisperer/IPs/issues",
"licenseId": 7,
"name": "ShadowWhisperer - Other Tunnel"
},
{
"description": "MalSilo threat intelligence feed containing malicious IPv4 addresses with threat categorization and metadata. This feed provides IP addresses associated with various malware families and threat actors.",
"homeUrl": "https://malsilo.gitlab.io/feeds/",
"id": 2806,
"licenseId": 5,
"name": "MalSilo IPv4 Feed"
},
{
"description": "MalSilo threat intelligence feed containing malicious URLs with threat categorization and metadata. This feed provides URLs associated with various malware families and threat actors.",
"homeUrl": "https://malsilo.gitlab.io/feeds/",
"id": 2807,
"licenseId": 5,
"name": "MalSilo URL Feed"
},
{
"description": "MalSilo threat intelligence feed containing malicious domains with threat categorization and metadata. This feed provides domains associated with various malware families and threat actors.",
"homeUrl": "https://malsilo.gitlab.io/feeds/",
"id": 2808,
"licenseId": 5,
"name": "MalSilo Domain Feed"
},
{
"description": "MalSilo Suricata DNS detection rules for identifying and blocking malicious DNS queries. These rules are designed for use with Suricata IDS/IPS systems.",
"homeUrl": "https://malsilo.gitlab.io/feeds/",
"id": 2809,
"licenseId": 5,
"name": "MalSilo DNS Rules"
},
{
"description": "MalSilo Suricata IP detection rules for identifying and blocking malicious IP traffic. These rules are designed for use with Suricata IDS/IPS systems.",
"homeUrl": "https://malsilo.gitlab.io/feeds/",
"id": 2810,
"licenseId": 5,
"name": "MalSilo IP Rules"
},
{
"description": "MalSilo Suricata URL detection rules for identifying and blocking malicious URL traffic. These rules are designed for use with Suricata IDS/IPS systems.",
"homeUrl": "https://malsilo.gitlab.io/feeds/",
"id": 2811,
"licenseId": 5,
"name": "MalSilo URL Rules"
}
]

View file

@ -6334,5 +6334,29 @@
{
"filterListId": 2805,
"maintainerId": 204
},
{
"filterListId": 2806,
"maintainerId": 205
},
{
"filterListId": 2807,
"maintainerId": 205
},
{
"filterListId": 2808,
"maintainerId": 205
},
{
"filterListId": 2809,
"maintainerId": 205
},
{
"filterListId": 2810,
"maintainerId": 205
},
{
"filterListId": 2811,
"maintainerId": 205
}
]

View file

@ -9262,5 +9262,29 @@
{
"filterListId": 2805,
"syntaxId": 9
},
{
"filterListId": 2806,
"syntaxId": 9
},
{
"filterListId": 2807,
"syntaxId": 2
},
{
"filterListId": 2808,
"syntaxId": 2
},
{
"filterListId": 2809,
"syntaxId": 48
},
{
"filterListId": 2810,
"syntaxId": 48
},
{
"filterListId": 2811,
"syntaxId": 48
}
]

View file

@ -13266,5 +13266,29 @@
{
"filterListId": 2805,
"tagId": 12
},
{
"filterListId": 2806,
"tagId": 6
},
{
"filterListId": 2807,
"tagId": 6
},
{
"filterListId": 2808,
"tagId": 6
},
{
"filterListId": 2809,
"tagId": 6
},
{
"filterListId": 2810,
"tagId": 6
},
{
"filterListId": 2811,
"tagId": 6
}
]

View file

@ -17563,5 +17563,41 @@
"id": 3192,
"primariness": 1,
"url": "https://raw.githubusercontent.com/ShadowWhisperer/IPs/master/Other/Tunnel"
},
{
"filterListId": 2806,
"id": 3193,
"primariness": 1,
"url": "https://malsilo.gitlab.io/feeds/dumps/ip_list.txt"
},
{
"filterListId": 2807,
"id": 3194,
"primariness": 1,
"url": "https://malsilo.gitlab.io/feeds/dumps/url_list.txt"
},
{
"filterListId": 2808,
"id": 3195,
"primariness": 1,
"url": "https://malsilo.gitlab.io/feeds/dumps/domain_list.txt"
},
{
"filterListId": 2809,
"id": 3196,
"primariness": 1,
"url": "https://malsilo.gitlab.io/feeds/dumps/malsilo-dns.rules"
},
{
"filterListId": 2810,
"id": 3197,
"primariness": 1,
"url": "https://malsilo.gitlab.io/feeds/dumps/malsilo-ip.rules"
},
{
"filterListId": 2811,
"id": 3198,
"primariness": 1,
"url": "https://malsilo.gitlab.io/feeds/dumps/malsilo-url.rules"
}
]

View file

@ -1053,5 +1053,11 @@
"id": 204,
"name": "ShadowWhisperer",
"url": "https://github.com/ShadowWhisperer"
},
{
"emailAddress": "malsilo@tuta.io",
"id": 205,
"name": "MalSilo",
"url": "https://malsilo.gitlab.io/feeds/"
}
]

View file

@ -212,5 +212,10 @@
"id": 57,
"name": "CSV",
"url": "https://en.wikipedia.org/wiki/Comma-separated_values"
},
{
"id": 58,
"name": "Suricata",
"url": "https://suricata.io/documentation/"
}
]