import "hash"

rule bulwark_https_bulwarkblack_com_megalodon_github_actions_cicd_secret_theft_defense
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/megalodon-github-actions-cicd-secret-theft-defense/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-07-15T22:32:21Z"
        tlp = "TLP:CLEAR"
        indicator_count = "8"
    strings:
        $s0 = "safedep.io" ascii wide nocase  // Domains
        $s1 = "teaak.com" ascii wide nocase  // Domains
        $s2 = "http://216.126.225.129:8443" ascii wide nocase  // URLs
        $s3 = "http://216.126.225.129:8443?h=megalodon&l=gh_dump&id=hefs8esnhgkx&quot" ascii wide nocase  // URLs
        $s4 = "216.126.225.129" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.sha1(0, filesize) == "18aa49e5f42ceaf9f010f01a396f625100c7aad8" or
        hash.sha1(0, filesize) == "8a454e601c4f69576c4e4edd14b8d2a0c52eaf27" or
        hash.sha1(0, filesize) == "acac5a9854650c4ae2883c4740bf87d34120c038"
}