import "hash"

rule bulwark_https_bulwarkblack_com_fileless_php_rootkit_bigip_process_hunting
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/fileless-php-rootkit-bigip-process-hunting/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-09-07T15:06:38Z"
        tlp = "TLP:CLEAR"
        indicator_count = "1"
    condition:
        hash.sha256(0, filesize) == "26bd5b0722d1dbab5db749a063c49bc8638653ac2addfead7a9cb3d6d57bccc9"
}