import "hash"

rule bulwark_https_bulwarkblack_com_storm_2561_weaponizes_seo_poisoning_to_deploy_trojanized_vpn_clie
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/storm-2561-weaponizes-seo-poisoning-to-deploy-trojanized-vpn-clients-and-steal-enterprise-credentials/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-27T00:00:00Z"
        tlp = "TLP:CLEAR"
        indicator_count = "33"
    strings:
        $s0 = "checkpoint-vpn.com" ascii wide nocase  // Domains
        $s1 = "cisco-secure-client.es" ascii wide nocase  // Domains
        $s2 = "co.uk" ascii wide nocase  // Domains
        $s3 = "forticlient-for-mac.com" ascii wide nocase  // Domains
        $s4 = "forticlient-vpn.de" ascii wide nocase  // Domains
        $s5 = "forticlient-vpn.fr" ascii wide nocase  // Domains
        $s6 = "forticlient-vpn.it" ascii wide nocase  // Domains
        $s7 = "forticlient.ca" ascii wide nocase  // Domains
        $s8 = "forticlient.co" ascii wide nocase  // Domains
        $s9 = "forticlient.co.uk" ascii wide nocase  // Domains
        $s10 = "forticlient.no" ascii wide nocase  // Domains
        $s11 = "fortinet-vpn.com" ascii wide nocase  // Domains
        $s12 = "ivanti-pulsesecure.com" ascii wide nocase  // Domains
        $s13 = "ivanti-secure-access.de" ascii wide nocase  // Domains
        $s14 = "ivanti-vpn.org" ascii wide nocase  // Domains
        $s15 = "myconnection.pro" ascii wide nocase  // Domains
        $s16 = "pn-connection.pro" ascii wide nocase  // Domains
        $s17 = "sonicwall-netextender.nl" ascii wide nocase  // Domains
        $s18 = "sophos-connect.org" ascii wide nocase  // Domains
        $s19 = "vpn-fortinet.com" ascii wide nocase  // Domains
        $s20 = "watchguard-vpn.com" ascii wide nocase  // Domains
        $s21 = "194.76.226.93" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.sha256(0, filesize) == "26db3fd959f12a61d19d102c1a0fb5ee7ae3661fa2b301135cdb686298989179" or
        hash.sha256(0, filesize) == "44906752f500b61d436411a121cab8d88edf614e1140a2d01474bd587a8d7ba8" or
        hash.sha256(0, filesize) == "57a50a1c04254df3db638e75a64d5dd3b0d6a460829192277e252dc0c157a62f" or
        hash.sha256(0, filesize) == "6129d717e4e3a6fb4681463e421a5603b640bc6173fb7ba45a41a881c79415ca" or
        hash.sha256(0, filesize) == "6c9ab17a4aff2cdf408815ec120718f19f1a31c13fc5889167065d448a40dfe6" or
        hash.sha256(0, filesize) == "85c4837e3337165d24c6690ca63a3274dfaaa03b2ddaca7f1d18b3b169c6aac1" or
        hash.sha256(0, filesize) == "862f004679d3b142d9d2c729e78df716aeeda0c7a87a11324742a5a8eda9b557" or
        hash.sha256(0, filesize) == "8ebe082a4b52ad737f7ed33ccc61024c9f020fd085c7985e9c90dc2008a15adc" or
        hash.sha256(0, filesize) == "98f21b8fa426fc79aa82e28669faac9a9c7fce9b49d75bbec7b60167e21963c9" or
        hash.sha256(0, filesize) == "cfa4781ebfa5a8d68b233efb723dbde434ca70b2f76ff28127ecf13753bfe011" or
        hash.sha256(0, filesize) == "eb8b81277c80eeb3c094d0a168533b07366e759a8671af8bfbe12d8bc87650c9"
}