rule bulwark_https_bulwarkblack_com_clop_south_staffs_water_soc_coverage_defense
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/clop-south-staffs-water-soc-coverage-defense/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-19T19:13:56Z"
        tlp = "TLP:CLEAR"
        indicator_count = "15"
    strings:
        $s0 = "decoded.avast.io" ascii wide nocase  // Domains
        $s1 = "ico.org" ascii wide nocase  // Domains
        $s2 = "ico.org.uk" ascii wide nocase  // Domains
        $s3 = "malpedia.caad.fkie.fraunhofer.de" ascii wide nocase  // Domains
        $s4 = "redcanary.com" ascii wide nocase  // Domains
        $s5 = "securityintelligence.com" ascii wide nocase  // Domains
        $s6 = "www.ransomware.live" ascii wide nocase  // Domains
        $s7 = "https://decoded.avast.io/janvojtesek/raspberry-robins-roshtyak-a-little-lesson-in-trickery/" ascii wide nocase  // URLs
        $s8 = "https://ico.org.uk/media2/xdrfahsw/south-staffordshire-plc-and-south-staffordshire-water-plc-monetary-penalty-notice.pdf" ascii wide nocase  // URLs
        $s9 = "https://malpedia.caad.fkie.fraunhofer.de/details/win.clop" ascii wide nocase  // URLs
        $s10 = "https://malpedia.caad.fkie.fraunhofer.de/details/win.get2" ascii wide nocase  // URLs
        $s11 = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sdbbot" ascii wide nocase  // URLs
        $s12 = "https://redcanary.com/blog/raspberry-robin" ascii wide nocase  // URLs
        $s13 = "https://securityintelligence.com/posts/raspberry-robin-worm-dridex-malware/" ascii wide nocase  // URLs
        $s14 = "https://www.ransomware.live/group/clop" ascii wide nocase  // URLs
    condition:
        any of ($s*)
}