import "hash"

rule bulwark_https_bulwarkblack_com_fire_ant_trusted_infrastructure_router_authentication_defense
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/fire-ant-trusted-infrastructure-router-authentication-defense/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-30T20:04:05Z"
        tlp = "TLP:CLEAR"
        indicator_count = "13"
    strings:
        $s0 = "libseconfd.so" ascii wide nocase  // Domains
    condition:
        any of ($s*) or
        hash.sha1(0, filesize) == "13f0c2a598e3aa63856c032a96b110aed963f0e8" or
        hash.sha1(0, filesize) == "1682b652a15bde732489f22809b0b7594c228fd3" or
        hash.sha1(0, filesize) == "1aa6ab2006b5d9199aa87bb0bbd995aec698ac4f" or
        hash.sha1(0, filesize) == "36005f5e4398a1c62a2a9271eddfcc1b44b1ad00" or
        hash.sha1(0, filesize) == "5ba1242050b5b447052b210788a5a25593d6987d" or
        hash.sha1(0, filesize) == "6ef7d2985edf743ebff413a9298a127e9475d72f" or
        hash.sha1(0, filesize) == "7dab017f14628345d47bd4eb69cc49224f3054a7" or
        hash.sha1(0, filesize) == "955cd45a2f6f226a2fdf44b329af1c8dde90cb38" or
        hash.sha1(0, filesize) == "c164bfc953c66e58b11fc280e69fd43b8f255839" or
        hash.sha1(0, filesize) == "b149fa3a34bd585e7a674a4fd9538437bd06f514" or
        hash.sha1(0, filesize) == "be6b27f429324a4af05a310d8ec9635e37c68a94" or
        hash.sha1(0, filesize) == "c164bfc953c66e58b11fc280e69fd43b8f255839"
}