// Selected evidence-qualified indicators only; not the complete article IOC inventory.
// Source context is not a confirmed-malicious verdict; verify before operational use.
import "hash"

rule bulwark_https_bulwarkblack_com_litellm_1_107_0_compromise_artifact_credential_recovery
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/litellm-1-107-0-compromise-artifact-credential-recovery/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-10-22T16:32:41Z"
        tlp = "TLP:CLEAR"
        indicator_count = "17"
    strings:
        $s0 = "ghcr.io" ascii wide nocase  // Domains
        $s1 = "litellm.ai" ascii wide nocase  // Domains
        $s2 = "litellm.dev" ascii wide nocase  // Domains
        $s3 = "models.litellm.cloud" ascii wide nocase  // Domains
        $s4 = "www.litellm.dev" ascii wide nocase  // Domains
        $s5 = "http://www.litellm.dev/healthcheck" ascii wide nocase  // URLs
        $s6 = "https://github.com/Berri-AI/litellm" ascii wide nocase  // URLs
        $s7 = "https://raw.githubusercontent.com/letters9813/pythonclient-test/main/domain.txt" ascii wide nocase  // URLs
    condition:
        any of ($s*) or
        hash.sha256(0, filesize) == "0aaf7ba346d41ef2f40390436738b001180d5a1c03aa093f121078a9969d9a1a" or
        hash.sha256(0, filesize) == "12d4ccc5c6f8d35cf4f2cf233b7f3e418e863e657d81ff5f5fc9e210005b9484" or
        hash.sha256(0, filesize) == "1bbce8caa94f01c0aaa0b7ddae51553a8a32e1ce53d96d44fe583272aff7ad00" or
        hash.sha256(0, filesize) == "2befe2a79fb4fbbd9a543b5b40b530c8cffa8771bab22b8fb22b2e4ae3b1f819" or
        hash.sha256(0, filesize) == "462d0c9f67ca522d9e0e4acd245e90b36ce0d5353604a66bb7c43a1ec4a6fcf7" or
        hash.sha256(0, filesize) == "668169d35b87bf51324080390b1b1c5ab12bd335cfe5f1a99e3689abd5e02ae6" or
        hash.sha256(0, filesize) == "7598727f209d717041db37f7dca271d3a7d328a279890e0e1d55375729aeb86d" or
        hash.sha256(0, filesize) == "bd1aeee419ea36da9aa2b657288da4101887be468f020ac63d22ba6ed84a3ea5" or
        hash.sha256(0, filesize) == "c2e32d0ce2548aa662c18bf5001911a79fe5b30cf8357132275add02fdcde054"
}