import "hash"

rule bulwark_https_bulwarkblack_com_owareaper_exchange_mailbox_compromise_review
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/owareaper-exchange-mailbox-compromise-review/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-09-07T01:07:08Z"
        tlp = "TLP:CLEAR"
        indicator_count = "12"
    strings:
        $s0 = "acocdn.com" ascii wide nocase  // Domains
        $s1 = "asecdns.com" ascii wide nocase  // Domains
        $s2 = "dnsrecursive.eu" ascii wide nocase  // Domains
        $s3 = "folder.id" ascii wide nocase  // Domains
        $s4 = "i3.wp.com" ascii wide nocase  // Domains
        $s5 = "images.weserv.nl" ascii wide nocase  // Domains
        $s6 = "schemas.xmlsoap.org" ascii wide nocase  // Domains
        $s7 = "slack-imgs.com" ascii wide nocase  // Domains
        $s8 = "tdndns.com" ascii wide nocase  // Domains
        $s9 = "http://schemas.xmlsoap.org/soap/envelope/" ascii wide nocase  // URLs
        $s10 = "https://images.weserv.nl/?url=https://acocdn.com/assets/v1_SGVsbG8gV29ybGQ" ascii wide nocase  // URLs
    condition:
        any of ($s*) or
        hash.sha256(0, filesize) == "6897b649f29e54d8910459963bbf94ed5c7a4fe66a56bc5962540b226b8e48c4"
}