import "hash"

rule bulwark_https_bulwarkblack_com_autonomous_ai_agent_espionage_finance_ministry_defense
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/autonomous-ai-agent-espionage-finance-ministry-defense/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-27T05:23:06Z"
        tlp = "TLP:CLEAR"
        indicator_count = "22"
    strings:
        $s0 = "cdn.jsdelivr.net" ascii wide nocase  // Domains
        $s1 = "dnsrd.com" ascii wide nocase  // Domains
        $s2 = "hunt.io" ascii wide nocase  // Domains
        $s3 = "java.io" ascii wide nocase  // Domains
        $s4 = "mail4.pl" ascii wide nocase  // Domains
        $s5 = "redhatupdating432.dnsrd.com" ascii wide nocase  // Domains
        $s6 = "103.97.0.57" ascii wide nocase  // IPv4
        $s7 = "118.107.222.232" ascii wide nocase  // IPv4
        $s8 = "202.181.27.115" ascii wide nocase  // IPv4
        $s9 = "43.246.208.207" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.sha256(0, filesize) == "0f8c905aa25c86f85454acb7e77bf5c50220c2a82e5b69a33741e55c8a85f2fc" or
        hash.sha256(0, filesize) == "2a4cb412efa93fed7c3b3b3e49d6247b11a95ce9fddf71d9fe9db8e5f0068e0d" or
        hash.sha256(0, filesize) == "5633bc0033fde3aad929d6cbd47c554e264180360b017aae04687c2d6d83f753" or
        hash.sha256(0, filesize) == "576c70e12be8b2e8e7c35a5feb082e90621989adce8e64400126918d37f13e49" or
        hash.sha256(0, filesize) == "58338a93fee4e008ea28e459c4d1598313d1524763ab13894ab63bf2bec4302a" or
        hash.sha256(0, filesize) == "9ff4b6d3b7dbb023bad65d2538ade745d46b763e5a12116c9c83aa2f6f5d96aa" or
        hash.sha256(0, filesize) == "a9447ae174f4aa54f760b7d7cc985c1a970f31e151d3ff66fac247f99ba1b509" or
        hash.sha256(0, filesize) == "b65b7ede835ebba36294d52d7780065523340ee09bb8b209ef2dc495e53dfd53" or
        hash.sha256(0, filesize) == "d252ee7b348b7e43e432d8fb154465838f5cd5fb564905323460e6f0a0c7d1e2" or
        hash.sha256(0, filesize) == "dbbb8a11a239da11cbaf99f847a2d032f34d3b522e13b0fd4ef7b2649da7123b" or
        hash.sha256(0, filesize) == "ec7e9ab43a0cc65d29f0b84a93ba88c43d01fed3dec5c968525dc73c03cbfda2" or
        hash.sha256(0, filesize) == "ff662b60f6a142f99292fbdd65dd1ccd79dc9628686ddf5935c92f7fb1b62a81"
}