import "hash"

rule bulwark_https_bulwarkblack_com_cyclops_blink_cisco_fmc_compromise_review
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/cyclops-blink-cisco-fmc-compromise-review/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-09-13T01:05:16Z"
        tlp = "TLP:CLEAR"
        indicator_count = "8"
    strings:
        $s0 = "104.218.165.253" ascii wide nocase  // IPv4
        $s1 = "208.123.119.215" ascii wide nocase  // IPv4
        $s2 = "43.204.2.142" ascii wide nocase  // IPv4
        $s3 = "89.34.96.56" ascii wide nocase  // IPv4
        $s4 = "91.214.78.118" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.sha256(0, filesize) == "6f98add5d1a7729192b6ad8491d85c505c64836f7881742d6b93bd8e3d2fe461" or
        hash.sha256(0, filesize) == "b037f45e02a289325a1a5eb0d4db6a9fce9954fd0fdfd07162cb4eb2acbef77d" or
        hash.sha256(0, filesize) == "db491181ece3f319de6567ab6f6daa90c6879911cd890155e6b7d8cc7a1a8c8e"
}