rule bulwark_https_bulwarkblack_com_apache_thrift_rpc_inventory_61_cves
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/apache-thrift-rpc-inventory-61-cves/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-10-05T01:05:10Z"
        tlp = "TLP:CLEAR"
        indicator_count = "65"
    strings:
        $s0 = "computation.run" ascii wide nocase  // Domains
        $s1 = "lists.apache.org" ascii wide nocase  // Domains
        $s2 = "www.cve.org" ascii wide nocase  // Domains
        $s3 = "https://lists.apache.org/thread/1rpq0d0g6yzjjzl1z27lwmvhzkn6rbrs" ascii wide nocase  // URLs
        $s4 = "https://lists.apache.org/thread/1zdvscq7p3hf3z30s26h4tm9dvljm1jj" ascii wide nocase  // URLs
        $s5 = "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1" ascii wide nocase  // URLs
        $s6 = "https://lists.apache.org/thread/35831rngzrqky1gvc32t06psgq1b8441" ascii wide nocase  // URLs
        $s7 = "https://lists.apache.org/thread/3wmvtvv56rky5wtszn4zr8w12kg928qn" ascii wide nocase  // URLs
        $s8 = "https://lists.apache.org/thread/52gwhsy947hj9qhgn0dql726z1q927g4" ascii wide nocase  // URLs
        $s9 = "https://lists.apache.org/thread/5hjh0gz8wf6bo7ydxjpqj92m42hwmfo8" ascii wide nocase  // URLs
        $s10 = "https://lists.apache.org/thread/5okpz47dv8hy0s3r6tmrplg3y7jzhhyw" ascii wide nocase  // URLs
        $s11 = "https://lists.apache.org/thread/5tjwbbyympbj16lblocv9b12s32sg113" ascii wide nocase  // URLs
        $s12 = "https://lists.apache.org/thread/64y7f0b89mnq4xoqcn4h26to8kskolgc" ascii wide nocase  // URLs
        $s13 = "https://lists.apache.org/thread/6hxll1jcnod9gfr225tz7my08lpj3jmt" ascii wide nocase  // URLs
        $s14 = "https://lists.apache.org/thread/6kl6g40tpl8zt3opd8fwn6bsgyddzhd5" ascii wide nocase  // URLs
        $s15 = "https://lists.apache.org/thread/7c23sgowkb3ssmolqofqsn8wzsddvf33" ascii wide nocase  // URLs
        $s16 = "https://lists.apache.org/thread/7o985t84551tpo55v6fsd3g42gs3zps1" ascii wide nocase  // URLs
        $s17 = "https://lists.apache.org/thread/7xqf651pvjykw0xr9vw0ooz0bwx7wzy7" ascii wide nocase  // URLs
        $s18 = "https://lists.apache.org/thread/8y04vvxw7ozxxh3c44vhoy7jsd6bonzq" ascii wide nocase  // URLs
        $s19 = "https://lists.apache.org/thread/8zbv1y4wzr3nn5mzmdph7b0n6tm0lc4m" ascii wide nocase  // URLs
        $s20 = "https://lists.apache.org/thread/9353rb8mpoq4ltff88h1j2y3hfy6blgb" ascii wide nocase  // URLs
        $s21 = "https://lists.apache.org/thread/94cvvzzl0rh707bn2j4zt844v547508g" ascii wide nocase  // URLs
        $s22 = "https://lists.apache.org/thread/971572orz86jdwlg58wqv8o50oqqb143" ascii wide nocase  // URLs
        $s23 = "https://lists.apache.org/thread/9d51ygo6hrsdo5ndwckbwt3mnp290m57" ascii wide nocase  // URLs
        $s24 = "https://lists.apache.org/thread/b4rrkrwoyqb9g7hk58d3fx09cbvp1tg9" ascii wide nocase  // URLs
        $s25 = "https://lists.apache.org/thread/bf12g1b11r4x9x3wsy4mgwfgd0t779h7" ascii wide nocase  // URLs
        $s26 = "https://lists.apache.org/thread/bjor9ttx7hk23gzcx60ohz0f20xzvgv0" ascii wide nocase  // URLs
        $s27 = "https://lists.apache.org/thread/c7f9g4027ok0gocyso2y84r2mhgc2xmy" ascii wide nocase  // URLs
        $s28 = "https://lists.apache.org/thread/cxkbblyht7988p2o6yvnmd6536qmt88k" ascii wide nocase  // URLs
        $s29 = "https://lists.apache.org/thread/dgy8ox9t4bh1xhf74ovf29ht87x7dno4" ascii wide nocase  // URLs
        $s30 = "https://lists.apache.org/thread/f9w4q6ttlc3k9404x4do25gdhqodtjnn" ascii wide nocase  // URLs
        $s31 = "https://lists.apache.org/thread/hrgcqlms4ksrz4qkqdjwoxxggdty7dgh" ascii wide nocase  // URLs
        $s32 = "https://lists.apache.org/thread/hv6b1nyk2p15gy5pmtprwo7z9m46mfcx" ascii wide nocase  // URLs
        $s33 = "https://lists.apache.org/thread/k14jfr1xwc0vtmm2s7xro6lt7q4y6s7m" ascii wide nocase  // URLs
        $s34 = "https://lists.apache.org/thread/k1t5r9sz7k5tn57cnf5khw2ywlxv6098" ascii wide nocase  // URLs
        $s35 = "https://lists.apache.org/thread/kv1zkwlt82lkkv20g29txr5pjnvo0pf8" ascii wide nocase  // URLs
        $s36 = "https://lists.apache.org/thread/kx3xdttoypl8j4dcxmqbq9dwy1w0kr7j" ascii wide nocase  // URLs
        $s37 = "https://lists.apache.org/thread/l2rgp3dqhpy2w347forzdt9g7o2d6k0d" ascii wide nocase  // URLs
        $s38 = "https://lists.apache.org/thread/lg97w2yvg3c6z06l8m5xs3j3v2m6mvj8" ascii wide nocase  // URLs
        $s39 = "https://lists.apache.org/thread/lpcmo2xjfyfww474xdyyfypkqthk9s14" ascii wide nocase  // URLs
        $s40 = "https://lists.apache.org/thread/n9rogg2166hl9y4ycq5njpvnxndr8y5o" ascii wide nocase  // URLs
        $s41 = "https://lists.apache.org/thread/nodwz7gjvogkkh3w1jwbsslk1c7t0727" ascii wide nocase  // URLs
        $s42 = "https://lists.apache.org/thread/nxlmlhgsh7fwr4mo1fkhtkw3v266qhcx" ascii wide nocase  // URLs
        $s43 = "https://lists.apache.org/thread/o5386v7ytbbjv9sx7dbszw46ypod5yd9" ascii wide nocase  // URLs
        $s44 = "https://lists.apache.org/thread/oqr0h2k1cg9hho3oh8trmovmxc04fl5m" ascii wide nocase  // URLs
        $s45 = "https://lists.apache.org/thread/ow8994gb5g8ssmmbkbl48xqb0tpvqyr3" ascii wide nocase  // URLs
        $s46 = "https://lists.apache.org/thread/p96mokqfy16mnqfyon46mf6g8nr9ghb6" ascii wide nocase  // URLs
        $s47 = "https://lists.apache.org/thread/poskkt3p754b2f293g63934hw160o86j" ascii wide nocase  // URLs
        $s48 = "https://lists.apache.org/thread/rbpwlhlxnv2qgyk8cfscp2d2fd3p0ojb" ascii wide nocase  // URLs
        $s49 = "https://lists.apache.org/thread/rflzpdvtk8yhpzg99wkf5yf277nn7267" ascii wide nocase  // URLs
        $s50 = "https://lists.apache.org/thread/rm0m34gt6fh1flvt16wty559hfg191qr" ascii wide nocase  // URLs
        $s51 = "https://lists.apache.org/thread/ro1y0ckzfzcc45yk9qkt1p6t4g2jvrfy" ascii wide nocase  // URLs
        $s52 = "https://lists.apache.org/thread/s8fjltl6c1pkm7vg9v4qkr89b5b74jbg" ascii wide nocase  // URLs
        $s53 = "https://lists.apache.org/thread/shy1rrm2g383wlbdb2p7w19c868ntdjp" ascii wide nocase  // URLs
        $s54 = "https://lists.apache.org/thread/tcg16jr59z5nry066dw7ym60vl25dxt9" ascii wide nocase  // URLs
        $s55 = "https://lists.apache.org/thread/v60w786pqr7njzz9425grby8yjrgmbsj" ascii wide nocase  // URLs
        $s56 = "https://lists.apache.org/thread/vxnk7cmdtoqjn97b8szlqym1mxx0xtzb" ascii wide nocase  // URLs
        $s57 = "https://lists.apache.org/thread/wdjyf4y115ybgdzz5m3gspo97lcmz1dt" ascii wide nocase  // URLs
        $s58 = "https://lists.apache.org/thread/xckvfky30kdnk8vqnhy0wndthvc9nymp" ascii wide nocase  // URLs
        $s59 = "https://lists.apache.org/thread/y05tvpv19ow44j16gtbcy9ht7lb0qjpy" ascii wide nocase  // URLs
        $s60 = "https://lists.apache.org/thread/yjz317wq7h86q9k8ws6ton0ojgl8hjct" ascii wide nocase  // URLs
        $s61 = "https://lists.apache.org/thread/zcgm7lx6037lvgvn87rc1tj3p0zhv371" ascii wide nocase  // URLs
        $s62 = "https://lists.apache.org/thread/zf8ppfpl6nqhp53sxnz6osnjw93g9fw2" ascii wide nocase  // URLs
        $s63 = "https://lists.apache.org/thread/zjv6hjmhl4tb4l4l1dk4bmc2whxh0lb4" ascii wide nocase  // URLs
        $s64 = "https://www.cve.org/CVERecord?id=" ascii wide nocase  // URLs
    condition:
        any of ($s*)
}