import "hash"

rule bulwark_https_bulwarkblack_com_siemens_software_center_clickfix_dll_sideloading_defense
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/siemens-software-center-clickfix-dll-sideloading-defense/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-10-19T20:02:51Z"
        tlp = "TLP:CLEAR"
        indicator_count = "13"
    strings:
        $s0 = "wizardexpensive.com" ascii wide nocase  // Domains
        $s1 = "www.siemens.com" ascii wide nocase  // Domains
        $s2 = "www.sw.siemens.com" ascii wide nocase  // Domains
        $s3 = "https://www.siemens.com/cert/advisories" ascii wide nocase  // URLs
        $s4 = "https://www.siemens.com/cert/operational-guidelines-industrial-security" ascii wide nocase  // URLs
        $s5 = "https://www.siemens.com/industrialsecurity" ascii wide nocase  // URLs
        $s6 = "https://www.siemens.com/productcert/terms-of-use" ascii wide nocase  // URLs
        $s7 = "https://www.sw.siemens.com/en-US/siemens-software-center/" ascii wide nocase  // URLs
        $s8 = "2.27.248.127" ascii wide nocase  // IPv4
        $s9 = "4.0.9.8" ascii wide nocase  // IPv4
        $s10 = "96.62.218.59" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.sha256(0, filesize) == "3fdcc7d7d049a89711fb31fb236940a1c5a09d899143ffd20c3c41fb1f2cf491" or
        hash.sha256(0, filesize) == "f4d7c5321bb0d1bda439304a753bcf9b467b98ca53c7e9493b9c2c3451092e4a"
}