import "hash"

rule bulwark_https_bulwarkblack_com_pan_os_captive_portal_zero_day_edge_device_review
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/pan-os-captive-portal-zero-day-edge-device-review/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-27T00:00:00Z"
        tlp = "TLP:CLEAR"
        indicator_count = "6"
    strings:
        $s0 = "http://146.70.100.69:8000/php_sess" ascii wide nocase  // URLs
        $s1 = "136.0.8.48" ascii wide nocase  // IPv4
        $s2 = "146.70.100.69" ascii wide nocase  // IPv4
        $s3 = "149.104.66.84" ascii wide nocase  // IPv4
        $s4 = "67.206.213.86" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.sha256(0, filesize) == "e11f69b49b6f2e829454371c31ebf86893f82a042dae3f2faf63dcd84f97a584"
}