import "hash"

rule bulwark_https_bulwarkblack_com_papercut_zero_day_print_server_edge_asset_discipline
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/papercut-zero-day-print-server-edge-asset-discipline/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-27T16:37:01Z"
        tlp = "TLP:CLEAR"
        indicator_count = "13"
    strings:
        $s0 = "entry.target.id" ascii wide nocase  // Domains
    condition:
        any of ($s*) or
        hash.sha256(0, filesize) == "0782c1d691b485160b498887b0b196bc2a228f51f398b5271b91127c804fc392" or
        hash.sha256(0, filesize) == "1d15e25718ed21d9aab74cf1fa30510fadb3c065a4444e6fb488a29f83ca1229" or
        hash.sha256(0, filesize) == "1f8e1eeda1d9c34be6e7d608a2c78e420a85f72112217d8e3759a8d97cdf73e8" or
        hash.sha256(0, filesize) == "2bde20ef100494cba154c38ae39020d5991b469765edb3472e56b5387b82d043" or
        hash.sha256(0, filesize) == "30595f7cb15218187de91547bbdea88eccdcfa37857d6f35e37c035272b82f94" or
        hash.sha256(0, filesize) == "530bba5bed0510add6be6d04c4e03759c5dc29d92f536481d1f013915bd837ee" or
        hash.sha256(0, filesize) == "5483518f8c2b6668df2d9135436c66548dc96fbeb5f6f6f809f643a7128b8806" or
        hash.sha256(0, filesize) == "7b5d635557c19baa234356f270da32da37c14ba03aac9f32694214e3585862d3" or
        hash.sha256(0, filesize) == "9294606825e928d59fb175caf73ccd6ca693d776d645808092f26c964e7cd8dd" or
        hash.sha256(0, filesize) == "a9a71d111f2233634b91e0e08fe6b6f74a09f69e73ca09df1e9189594d1b1295" or
        hash.sha256(0, filesize) == "eaae9cfb9fdd774d4260b50e7d4c9de70953f7a87eecc76635994d8913f41742" or
        hash.sha256(0, filesize) == "f5e8278245b6e73901de23d86032207508d6b6e4720d90406cf218566a63454f"
}