import "hash"

rule bulwark_https_bulwarkblack_com_captivecrunch_travel_wifi_identity_attack_surface
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/captivecrunch-travel-wifi-identity-attack-surface/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-14T20:06:03Z"
        tlp = "TLP:CLEAR"
        indicator_count = "12"
    strings:
        $s0 = "m365-owa.com" ascii wide nocase  // Domains
        $s1 = "ms365-device.com" ascii wide nocase  // Domains
        $s2 = "ms365-live.com" ascii wide nocase  // Domains
        $s3 = "owa-ms365.com" ascii wide nocase  // Domains
        $s4 = "104.194.159.150" ascii wide nocase  // IPv4
        $s5 = "107.189.26.194" ascii wide nocase  // IPv4
        $s6 = "213.145.86.112" ascii wide nocase  // IPv4
        $s7 = "31.57.243.154" ascii wide nocase  // IPv4
        $s8 = "38.146.28.132" ascii wide nocase  // IPv4
        $s9 = "38.146.28.75" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.sha256(0, filesize) == "918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593" or
        hash.sha256(0, filesize) == "be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c"
}