import "hash"

rule bulwark_https_bulwarkblack_com_screening_serpens_recruiting_espionage_attack_surface
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/screening-serpens-recruiting-espionage-attack-surface/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-27T00:00:00Z"
        tlp = "TLP:CLEAR"
        indicator_count = "41"
    strings:
        $s0 = "2117.filemail.com" ascii wide nocase  // Domains
        $s1 = "buisness-centeral-transportation.azurewebsites.net" ascii wide nocase  // Domains
        $s2 = "buisness-centeral-transportation.com" ascii wide nocase  // Domains
        $s3 = "buisness-centeral.azurewebsites.net" ascii wide nocase  // Domains
        $s4 = "business-startup.azurewebsites.net" ascii wide nocase  // Domains
        $s5 = "business-startup.org" ascii wide nocase  // Domains
        $s6 = "businessstartup.azurewebsites.net" ascii wide nocase  // Domains
        $s7 = "docspace-twpf0e.onlyoffice.com" ascii wide nocase  // Domains
        $s8 = "docspace-y4cumb.onlyoffice.com" ascii wide nocase  // Domains
        $s9 = "elementshift.azurewebsites.net" ascii wide nocase  // Domains
        $s10 = "filemail.com" ascii wide nocase  // Domains
        $s11 = "licencemanagers.azurewebsites.net" ascii wide nocase  // Domains
        $s12 = "licencesupporting.azurewebsites.net" ascii wide nocase  // Domains
        $s13 = "nanomatrix.azurewebsites.net" ascii wide nocase  // Domains
        $s14 = "peerdistsvcmanagers.azurewebsites.net" ascii wide nocase  // Domains
        $s15 = "premier-healthadvisory.azurewebsites.net" ascii wide nocase  // Domains
        $s16 = "premierhealthadvisory.azurewebsites.net" ascii wide nocase  // Domains
        $s17 = "premierhealthadvisory.com" ascii wide nocase  // Domains
        $s18 = "quantumweave.azurewebsites.net" ascii wide nocase  // Domains
        $s19 = "ramiltons-finance.azurewebsites.net" ascii wide nocase  // Domains
        $s20 = "ramiltonsfinance.azurewebsites.net" ascii wide nocase  // Domains
        $s21 = "ramiltonsfinance.com" ascii wide nocase  // Domains
        $s22 = "themesmanagers.azurewebsites.net" ascii wide nocase  // Domains
        $s23 = "themesprovidermanagers.azurewebsites.net" ascii wide nocase  // Domains
        $s24 = "https://2117.filemail.com/api/file/get?filekey=T0EnWQ6NugHkW_kLfDxPBEw_um6NSkg9ZwNRQ_5lrKrLLUo35pV8m3TKv1LqF3zZzdUm" ascii wide nocase  // URLs
        $s25 = "https://elementshift.azurewebsites.net" ascii wide nocase  // URLs
        $s26 = "https://nanomatrix.azurewebsites.net" ascii wide nocase  // URLs
        $s27 = "https://quantumweave.azurewebsites.net" ascii wide nocase  // URLs
    condition:
        any of ($s*) or
        hash.md5(0, filesize) == "edcdba624ddb43c2a1dcf334aa493068" or
        hash.sha256(0, filesize) == "0db36a04d304ad96f9e6f97b531934594cd95a5cea9ff2c9af249201089dc864" or
        hash.sha256(0, filesize) == "332ba2f0297dfb1599adecc3e9067893e7cf243aa23aedce4906a4c480574c17" or
        hash.sha256(0, filesize) == "38bd137c672bd58d08c4f0502f993a6561e2c3411773d1ae57ee0151a0a9d11d" or
        hash.sha256(0, filesize) == "43dc62cef52ebdd69e79f10015b3e13890f26c058325c0ff139c70f8d8eadcfa" or
        hash.sha256(0, filesize) == "44f4f7aca7f1d9bfdaf7b3736934cbe19f851a707662f8f0b0c49b383e054250" or
        hash.sha256(0, filesize) == "74882085db2088356ed7f72f01e0404a0a98cda88ef56fb15ce74c1f36b26d27" or
        hash.sha256(0, filesize) == "8808c794c24367438f183e4be941876f1d3ecd0c8d2eb43b10d2380841d2283b" or
        hash.sha256(0, filesize) == "9cf029daca89523d917dafed0568d11d00e45ec96b5b90b4a1f7fd4018c7da84" or
        hash.sha256(0, filesize) == "9e4a658e6d831c9e9bdfe11884a75b7c64812ed0a80e8495ddf6b316505acac1" or
        hash.sha256(0, filesize) == "b19e06da580cf91691eda066ac9ee4b09c6e5dc26c367af12660fe1f9306eec4" or
        hash.sha256(0, filesize) == "bc3b44154518c5794ce639108e7b9c5fecb0c189607a26de1aaed518d890c7ad" or
        hash.sha256(0, filesize) == "d4a7e9f107fe40c1a5d0139c6c6e25bf6bf57f61feff090bee28f476bb3cc3c2"
}