rule bulwark_https_bulwarkblack_com_session_cookie_bypass_sso_trust_boundary
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/session-cookie-bypass-sso-trust-boundary/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-10-02T20:03:29Z"
        tlp = "TLP:CLEAR"
        indicator_count = "4"
    strings:
        $s0 = "hmac.new" ascii wide nocase  // Domains
        $s1 = "subprocess.run" ascii wide nocase  // Domains
        $s2 = "target.com" ascii wide nocase  // Domains
        $s3 = "user.id" ascii wide nocase  // Domains
    condition:
        any of ($s*)
}