import "hash"

rule bulwark_https_bulwarkblack_com_noderabbit_pollcat_recruiting_lure_developer_workstation_defense
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/noderabbit-pollcat-recruiting-lure-developer-workstation-defense/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-09-01T20:08:00Z"
        tlp = "TLP:CLEAR"
        indicator_count = "62"
    strings:
        $s0 = "aceofspadesmanagement.com" ascii wide nocase  // Domains
        $s1 = "crossdwm.azurewebsites.net" ascii wide nocase  // Domains
        $s2 = "digimediaskill.com" ascii wide nocase  // Domains
        $s3 = "dnshnsdev.azurewebsites.net" ascii wide nocase  // Domains
        $s4 = "gamebarapp.azurewebsites.net" ascii wide nocase  // Domains
        $s5 = "gamebarappinformation.azurewebsites.net" ascii wide nocase  // Domains
        $s6 = "glmediaagency.com" ascii wide nocase  // Domains
        $s7 = "greenyjsgfd.azurewebsites.net" ascii wide nocase  // Domains
        $s8 = "healthcomfsdpower.com" ascii wide nocase  // Domains
        $s9 = "healthful-hub.com" ascii wide nocase  // Domains
        $s10 = "healthfullyrecipes.com" ascii wide nocase  // Domains
        $s11 = "healthvitalitycare.com" ascii wide nocase  // Domains
        $s12 = "healthyweightplan.com" ascii wide nocase  // Domains
        $s13 = "hecowime-aqdphyd4bbdef6es.westeurope-01.azurewebsites.net" ascii wide nocase  // Domains
        $s14 = "helptellerbls.azurewebsites.net" ascii wide nocase  // Domains
        $s15 = "hpjumpsrv.azurewebsites.net" ascii wide nocase  // Domains
        $s16 = "kyrasey-f8hfexa5cqamh7fk.westeurope-01.azurewebsites.net" ascii wide nocase  // Domains
        $s17 = "lifespotify.com" ascii wide nocase  // Domains
        $s18 = "mens-health-online.com" ascii wide nocase  // Domains
        $s19 = "msmanagementgrp.com" ascii wide nocase  // Domains
        $s20 = "msmanagementgrpmedia.com" ascii wide nocase  // Domains
        $s21 = "naturalapplication.azurewebsites.net" ascii wide nocase  // Domains
        $s22 = "neumedicahealthcare.com" ascii wide nocase  // Domains
        $s23 = "onlyoffice.com" ascii wide nocase  // Domains
        $s24 = "optimumhealthcredit.com" ascii wide nocase  // Domains
        $s25 = "oracle-challenge.s3.us-east-1.amazonaws.com" ascii wide nocase  // Domains
        $s26 = "plugplay.azurewebsites.net" ascii wide nocase  // Domains
        $s27 = "refreshhealthandwellness.com" ascii wide nocase  // Domains
        $s28 = "retaildemo.azurewebsites.net" ascii wide nocase  // Domains
        $s29 = "rgbteller.azurewebsites.net" ascii wide nocase  // Domains
        $s30 = "sahi-finance.com" ascii wide nocase  // Domains
        $s31 = "storview.azurewebsites.net" ascii wide nocase  // Domains
        $s32 = "timedrv.azurewebsites.net" ascii wide nocase  // Domains
        $s33 = "tubitak.azurewebsites.net" ascii wide nocase  // Domains
        $s34 = "userwellgtfs.azurewebsites.net" ascii wide nocase  // Domains
        $s35 = "visitfinancedentists.com" ascii wide nocase  // Domains
        $s36 = "wdisystem.azurewebsites.net" ascii wide nocase  // Domains
        $s37 = "wslmenus.azurewebsites.net" ascii wide nocase  // Domains
        $s38 = "wslwebui.azurewebsites.net" ascii wide nocase  // Domains
        $s39 = "https://gamebarapp.azurewebsites.net" ascii wide nocase  // URLs
        $s40 = "https://gamebarappinformation.azurewebsites.net" ascii wide nocase  // URLs
        $s41 = "https://healthcomfsdpower.com" ascii wide nocase  // URLs
        $s42 = "https://kyrasey-f8hfexa5cqamh7fk.westeurope-01.azurewebsites.net" ascii wide nocase  // URLs
        $s43 = "https://lifespotify.com/api/users/b879746e-fed9-4211-a6da-4d8223681267/otp/validate" ascii wide nocase  // URLs
        $s44 = "https://oracle-challenge.s3.us-east-1.amazonaws.com/Front-Technical-Challenge.zip" ascii wide nocase  // URLs
        $s45 = "https://plugplay.azurewebsites.net" ascii wide nocase  // URLs
        $s46 = "https://rgbteller.azurewebsites.net" ascii wide nocase  // URLs
        $s47 = "https://sahi-finance.com" ascii wide nocase  // URLs
        $s48 = "https://visitfinancedentists.com" ascii wide nocase  // URLs
        $s49 = "https://wslwebui.azurewebsites.net" ascii wide nocase  // URLs
    condition:
        any of ($s*) or
        hash.md5(0, filesize) == "0962f56d7ec69f4f2a0162dcbe22116b" or
        hash.md5(0, filesize) == "1ea83e4e4592b01e4acab63eb867bee5" or
        hash.md5(0, filesize) == "291ac3abe73c5158e59a437b75d5f0aa" or
        hash.md5(0, filesize) == "366515822d5ac1cc500711ef57a2e32e" or
        hash.md5(0, filesize) == "795e053a990a1569ffdcb57f48f6d085" or
        hash.md5(0, filesize) == "810f8e3b88eb05f710c09552941d6f56" or
        hash.md5(0, filesize) == "be086789568441d0d7e4679aee51f566" or
        hash.md5(0, filesize) == "cbaaf0900a13f28e380f49adecec932c" or
        hash.md5(0, filesize) == "cf449f1992c2819e62ac44a0b06ac2e7" or
        hash.md5(0, filesize) == "de5af16a3757ef700b01dc34d67079ae" or
        hash.md5(0, filesize) == "e259c5edf158aac4cfe14f77ddd0b196" or
        hash.md5(0, filesize) == "e95a4366686e3f786ea3c056fab5b0da"
}