import "hash"

rule bulwark_https_bulwarkblack_com_f5_confluence_edge_identity_attack_path
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/f5-confluence-edge-identity-attack-path/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-07-15T22:31:12Z"
        tlp = "TLP:CLEAR"
        indicator_count = "11"
    strings:
        $s0 = "my.f5.com" ascii wide nocase  // Domains
        $s1 = "www.darktrace.com" ascii wide nocase  // Domains
        $s2 = "http://206.189.27.39:8888/5" ascii wide nocase  // URLs
        $s3 = "https://my.f5.com/manage/s/article/K000156741" ascii wide nocase  // URLs
        $s4 = "https://www.darktrace.com/blog/darktraces-view-on-operation-lunar-peek-exploitation-of-palo-alto-firewall-devices-cve-2024-2012-and-2024-9474" ascii wide nocase  // URLs
        $s5 = "206.189.27.39" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.sha256(0, filesize) == "4a927d031919fd6bd88d3c8a917214b54bca00f8ddc80ecfe4d230663dda7465" or
        hash.sha256(0, filesize) == "57b3188e24782c27fdf72493ce599537efd3187d03b80f8afe733c72d68c5517" or
        hash.sha256(0, filesize) == "710a9d2653c8bd3689e451778dab9daec0de4c4c75f900788ccf23ef254b122a" or
        hash.sha256(0, filesize) == "b4592cea69699b2c0737d4e19cff7dca17b5baf5a238cd6da950a37e9986f216" or
        hash.sha256(0, filesize) == "bdd5da81ac34d9faa2a5118d4ed8f492239734be02146cd24a0e34270a48a455"
}