rule bulwark_https_bulwarkblack_com_macos_screen_sharing_exploitation_remote_access_exposure_control
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/macos-screen-sharing-exploitation-remote-access-exposure-control/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-28T15:05:08Z"
        tlp = "TLP:CLEAR"
        indicator_count = "6"
    strings:
        $s0 = "ctipilot.ch" ascii wide nocase  // Domains
        $s1 = "reverse.put.as" ascii wide nocase  // Domains
        $s2 = "https://ctipilot.ch/entries/2026-08-11/cve-2026-65400-screensharingd-remote-root-two-preauth-bugs/" ascii wide nocase  // URLs
        $s3 = "https://github.com/panchocosil/CVE-2026-65400-poc.git" ascii wide nocase  // URLs
        $s4 = "https://reverse.put.as/2026/07/29/its-a-pre-auth-stupid/" ascii wide nocase  // URLs
        $s5 = "contact@resecurity.com" ascii wide nocase  // Email Addresses
    condition:
        any of ($s*)
}