rule bulwark_https_bulwarkblack_com_artex_ai_bank_attacks_agentic_incident_response
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/artex-ai-bank-attacks-agentic-incident-response/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-10-10T15:03:54Z"
        tlp = "TLP:CLEAR"
        indicator_count = "14"
    strings:
        $s0 = "khan.co.kr" ascii wide nocase  // Domains
        $s1 = "xcai.pro" ascii wide nocase  // Domains
        $s2 = "http://38.244.50.120:18899/.claude/CLAUDE.md" ascii wide nocase  // URLs
        $s3 = "https://www.khan.co.kr/en/article/202610042320007" ascii wide nocase  // URLs
        $s4 = "101.53.80.20" ascii wide nocase  // IPv4
        $s5 = "103.248.148.84" ascii wide nocase  // IPv4
        $s6 = "124.155.252.63" ascii wide nocase  // IPv4
        $s7 = "154.201.79.246" ascii wide nocase  // IPv4
        $s8 = "203.160.133.172" ascii wide nocase  // IPv4
        $s9 = "205.214.59.31" ascii wide nocase  // IPv4
        $s10 = "209.209.85.38" ascii wide nocase  // IPv4
        $s11 = "23.158.220.98" ascii wide nocase  // IPv4
        $s12 = "23.248.249.90" ascii wide nocase  // IPv4
        $s13 = "38.244.50.120" ascii wide nocase  // IPv4
    condition:
        any of ($s*)
}