// Selected evidence-qualified indicators only; not the complete article IOC inventory.
// Source context is not a confirmed-malicious verdict; verify before operational use.
rule bulwark_https_bulwarkblack_com_stolen_app_secrets_agentic_cloud_intrusions_workload_identity_rec
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/stolen-app-secrets-agentic-cloud-intrusions-workload-identity-recovery/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-11-07T03:24:27Z"
        tlp = "TLP:CLEAR"
        indicator_count = "5"
    strings:
        $s0 = "134.209.82.225" ascii wide nocase  // IPv4
        $s1 = "157.22.126.128" ascii wide nocase  // IPv4
        $s2 = "199.19.77.18" ascii wide nocase  // IPv4
        $s3 = "199.19.77.84" ascii wide nocase  // IPv4
        $s4 = "65.87.223.26" ascii wide nocase  // IPv4
    condition:
        any of ($s*)
}