import "hash"

rule bulwark_https_bulwarkblack_com_shinyhunters_peoplesoft_cve_2026_35273_erp_admin_endpoints
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/shinyhunters-peoplesoft-cve-2026-35273-erp-admin-endpoints/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-07-15T22:57:04Z"
        tlp = "TLP:CLEAR"
        indicator_count = "12"
    strings:
        $s0 = "azurenetfiles.net" ascii wide nocase  // Domains
        $s1 = "142.11.200.186" ascii wide nocase  // IPv4
        $s2 = "142.11.200.187" ascii wide nocase  // IPv4
        $s3 = "142.11.200.188" ascii wide nocase  // IPv4
        $s4 = "142.11.200.189" ascii wide nocase  // IPv4
        $s5 = "142.11.200.190" ascii wide nocase  // IPv4
        $s6 = "176.120.22.24" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.sha256(0, filesize) == "2ab684d93c1553fad87041b4dea97188a97e78589deee2a7bacff905564f3a35" or
        hash.sha256(0, filesize) == "68257a6f9ff196179ec03624e849927f26599eb180a7c82e14ef5bc4e93bc309" or
        hash.sha256(0, filesize) == "c7e9332731b06644fc73e0046a2a89eaa59b09f54250e9bd622467187351711f" or
        hash.sha256(0, filesize) == "d83fdb9e53c5ff03c4cb0451ea1bebd79b53f29eadc1e2fa394c7af13a86ce2f" or
        hash.sha256(0, filesize) == "f02a924c9ff92a8780ce812511341182c6b509d45bc59f3f7b522e37225d24fc"
}