import "hash"

rule bulwark_https_bulwarkblack_com_poisoned_search_ai_screenconnect_cryptojacking_defense
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/poisoned-search-ai-screenconnect-cryptojacking-defense/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-27T05:25:35Z"
        tlp = "TLP:CLEAR"
        indicator_count = "26"
    strings:
        $s0 = "direct-download.giize.com" ascii wide nocase  // Domains
        $s1 = "direct-download.gleeze.com" ascii wide nocase  // Domains
        $s2 = "direct-downloads.giize.com" ascii wide nocase  // Domains
        $s3 = "directdownload.icu" ascii wide nocase  // Domains
        $s4 = "dynu.com" ascii wide nocase  // Domains
        $s5 = "free-download.giize.com" ascii wide nocase  // Domains
        $s6 = "giize.com" ascii wide nocase  // Domains
        $s7 = "gleeze.com" ascii wide nocase  // Domains
        $s8 = "minemine.gleeze.com" ascii wide nocase  // Domains
        $s9 = "start-download.gleeze.com" ascii wide nocase  // Domains
        $s10 = "193.42.11.108" ascii wide nocase  // IPv4
        $s11 = "198.23.185.238" ascii wide nocase  // IPv4
        $s12 = "2.59.132.106" ascii wide nocase  // IPv4
        $s13 = "93.115.10.35" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.sha256(0, filesize) == "062bb28765fbaa11f8cc341fa16e2c7f942a122d929cb41f4a0f755b4429f246" or
        hash.sha256(0, filesize) == "16562974deec80e41ef57a71a6de8c03ceb393005fb1432f8d9d82c61294ef8c" or
        hash.sha256(0, filesize) == "1b2555b09ac62164638f47c8272beb6b0f97186e37d3a54cb84c723ff7a2eee5" or
        hash.sha256(0, filesize) == "2ee93ccbcd49ed94c65dcf52e7dcb8f0fa0a443ca24c0e0c7f79152efba657b7" or
        hash.sha256(0, filesize) == "69077fcf940fc5852fb32beed15636756ebc04ac971b7ed71d36251e7ea70a20" or
        hash.sha256(0, filesize) == "7035c2abeb617e828dfda1b119b8544fa9ae15a1d263d18bc5506acaf381f496" or
        hash.sha256(0, filesize) == "9ff07c9fafa9c03fdf69e4abf6806aa7c938b5480e7e258f227db0719ecd6386" or
        hash.sha256(0, filesize) == "a460d00ef93c8ce70d32e48e55781af66a53328fc2dde45519be196c265de074" or
        hash.sha256(0, filesize) == "c7425fbe6c3a4937934215c54027d4b67202d12ab490682fae03498870d66d06" or
        hash.sha256(0, filesize) == "cf3f8160eb5a5580e0c35054847e3ac4d01e9fe74fab8bc12bf6e8a40bf696b2" or
        hash.sha256(0, filesize) == "db2d33c4e6e4a5c2263b56e8303c343305a94dde1fc2968304ba260acbbd9f9f" or
        hash.sha256(0, filesize) == "e021662a652ba95c8778b991056696ab3c9b0f60d5e23b1e6cf73c3847db6610"
}