import "hash"

rule bulwark_https_bulwarkblack_com_peoplesoft_waf_bypass_patch_first_defense
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/peoplesoft-waf-bypass-patch-first-defense/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-09-27T15:05:00Z"
        tlp = "TLP:CLEAR"
        indicator_count = "17"
    strings:
        $s0 = "a.read" ascii wide nocase  // Domains
        $s1 = "azurenetfiles.net" ascii wide nocase  // Domains
        $s2 = "enroll.azuredevice.cloud" ascii wide nocase  // Domains
        $s3 = "g.read" ascii wide nocase  // Domains
        $s4 = "i.read" ascii wide nocase  // Domains
        $s5 = "java.io" ascii wide nocase  // Domains
        $s6 = "microsoft-entra.net" ascii wide nocase  // Domains
        $s7 = "os.name" ascii wide nocase  // Domains
        $s8 = "winmanage-me.network" ascii wide nocase  // Domains
        $s9 = "104.219.234.138" ascii wide nocase  // IPv4
        $s10 = "162.219.30.165" ascii wide nocase  // IPv4
        $s11 = "5.199.162.157" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.sha256(0, filesize) == "2bee941fb40519d0d1ec52bd79a8f63fc65aac6455c8f2d6b668e3360dfdb5d7" or
        hash.sha256(0, filesize) == "3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3" or
        hash.sha256(0, filesize) == "419c571ee38b7e7266d130c4b6bbc4dd0ef44d6e5f3bc02cc2cf73b762f07c86" or
        hash.sha256(0, filesize) == "48b4a0827da7bbfce9fb52464f8a659dea7a035189c52c506c0bfb4b1c3fe494" or
        hash.sha256(0, filesize) == "ba14419beb2ec0bb94cab6298c14d7fb3e1d819366fe378290c0c2a4d97f7e07"
}