import "hash"

rule bulwark_https_bulwarkblack_com_fox_tempest_code_signing_trust_weaponized
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/fox-tempest-code-signing-trust-weaponized/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-27T05:24:06Z"
        tlp = "TLP:CLEAR"
        indicator_count = "6"
    strings:
        $s0 = "signspace.cloud" ascii wide nocase  // Domains
    condition:
        any of ($s*) or
        hash.sha1(0, filesize) == "7e6d9dac619c04ae1b3c8c0906123e752ed66d63" or
        hash.sha1(0, filesize) == "dc0acb01e3086ea8a9cb144a5f97810d291020ce" or
        hash.sha256(0, filesize) == "11af4566539ad3224e968194c7a9ad7b596460d8f6e423fc62d1ea5fc0724326" or
        hash.sha256(0, filesize) == "f0668ce925f36ff7f3359b0ea47e3fa243af13cd6ad9661dfccc9ff79fb4f1cc" or
        hash.sha256(0, filesize) == "f0a6b89ec7eee83274cd484cea526b970a3ef28038799b0a5774bb33c5793b55"
}