import "hash"

rule bulwark_https_bulwarkblack_com_shai_hulud_ai_scanner_evasion_package_supply_chain_defense
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/shai-hulud-ai-scanner-evasion-package-supply-chain-defense/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-27T05:26:00Z"
        tlp = "TLP:CLEAR"
        indicator_count = "9"
    strings:
        $s0 = "anthropic.com" ascii wide nocase  // Domains
        $s1 = "api.anthropic.com" ascii wide nocase  // Domains
        $s2 = "fulcio.sigstore.dev" ascii wide nocase  // Domains
        $s3 = "litellm.cloud" ascii wide nocase  // Domains
        $s4 = "models.litellm.cloud" ascii wide nocase  // Domains
        $s5 = "https://api.anthropic.com/v1/api" ascii wide nocase  // URLs
    condition:
        any of ($s*) or
        hash.sha256(0, filesize) == "c539766062555d47716f8432e73adbe3a0c0c954a0b6c4005017a668975e275c" or
        hash.sha256(0, filesize) == "dc48b09b2a5954f7ff79ab8a2fd80202bd3b59c08c7cdbc6025aa923cb4c0efe" or
        hash.sha256(0, filesize) == "e1342a80d4b5e83d2c7c22e1e0aaa95f2d88e3dbf0d853a4994b180c93a4b17d"
}