import "hash"

rule bulwark_https_bulwarkblack_com_ai_enabled_malware_telemetry_defense
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/ai-enabled-malware-telemetry-defense/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-25T15:05:14Z"
        tlp = "TLP:CLEAR"
        indicator_count = "12"
    condition:
        hash.sha256(0, filesize) == "1619bcad3785be31ac2fdee0ab91392d08d9392032246e42673c3cb8964d4cb7" or
        hash.sha256(0, filesize) == "20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d" or
        hash.sha256(0, filesize) == "4fb58687a364c3f6d6f7e0ca03654f9dec0f8832a499d61d40b0d424db1b1b14" or
        hash.sha256(0, filesize) == "5226ea8e0f516565ba825a1bbed10020982c16414750237068b602c5b4ac6abd" or
        hash.sha256(0, filesize) == "66dbf939c00b09d8d22c692864b68c4a602e7a59c4b925b2e2bef57b1ad047bd" or
        hash.sha256(0, filesize) == "b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb" or
        hash.sha256(0, filesize) == "bb932056cae8940742e50b4f2b994a802e703f7bc235e7dd647d085ae2b2baf7" or
        hash.sha256(0, filesize) == "c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c" or
        hash.sha256(0, filesize) == "c398b3e06ef860670b9597daed85632834fa961aea87164b8ba8bb2f094a14ef" or
        hash.sha256(0, filesize) == "dcf536edd67a98868759f4e72bcbd1f4404c70048a2a3257e77d8af06cb036ac" or
        hash.sha256(0, filesize) == "dd15ce869aa79884753e3baad19b0437075202be86268b84f3ec2303e1ecd966" or
        hash.sha256(0, filesize) == "e622f3b743c7fc0a011b07a2e656aa2b5e50a4876721bcf1f405d582ca4cda22"
}