import "hash"

rule bulwark_https_bulwarkblack_com_fortimail_cve_2026_104286_email_appliance_incident_response
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/fortimail-cve-2026-104286-email-appliance-incident-response/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-10-02T01:04:28Z"
        tlp = "TLP:CLEAR"
        indicator_count = "16"
    strings:
        $s0 = "45.129.0.192" ascii wide nocase  // IPv4
        $s1 = "79.141.169.187" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.md5(0, filesize) == "49a7156a7d043cc8f9f680579db22f86" or
        hash.md5(0, filesize) == "5241738a3e9988404239e12243f6d35b" or
        hash.md5(0, filesize) == "61af1c4bce1c2eebc8ff689ca5337791" or
        hash.md5(0, filesize) == "64c90a00c7fda4d5c7973ed64c25783a" or
        hash.md5(0, filesize) == "8eb64f25d2a8e18e05aae058629473cf" or
        hash.md5(0, filesize) == "ae0ea6502d3fa5f0664bceb73189eb54" or
        hash.md5(0, filesize) == "f90fa81a5f521d785f2b2f765e3ab897" or
        hash.sha256(0, filesize) == "4000276a150a165d3c2537d1e19fb393c4de8333076a16655e28059cae82157b" or
        hash.sha256(0, filesize) == "703e97c64e61e41dc3aaba580d82bb2aa7b6a11b54ee6fb467ed5d5a3bffdef5" or
        hash.sha256(0, filesize) == "77324ac428bde86d351fc5fc06f6d64a6bfe737dfb2743df1d4c5ac2418a5b6a" or
        hash.sha256(0, filesize) == "7a6cea9f5c9e2e9994d4e3c4da73f86cf5acd05ea5d312c066c9d1dafd69ee38" or
        hash.sha256(0, filesize) == "8015f34dc84922b03688399d7f9fe7a00361789f7e420c7e2a2cdb23e75cef84" or
        hash.sha256(0, filesize) == "8953ec7960b09f544a880b072ad4e6cfda7a8303f486251d3478dcfdfbac23b6" or
        hash.sha256(0, filesize) == "d6fe51c22b91776f4c961ea58bcac5917f15d560a619d7ce726d3d51795609d3"
}