import "hash"

rule bulwark_https_bulwarkblack_com_ta419_ai_policy_espionage_phishing_defense
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/ta419-ai-policy-espionage-phishing-defense/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-10-01T15:03:41Z"
        tlp = "TLP:CLEAR"
        indicator_count = "24"
    strings:
        $s0 = "1drv.ms" ascii wide nocase  // Domains
        $s1 = "cirrushare.co" ascii wide nocase  // Domains
        $s2 = "cloudsyncpulse.com" ascii wide nocase  // Domains
        $s3 = "driftshare.co" ascii wide nocase  // Domains
        $s4 = "fileswiftonline.cloud" ascii wide nocase  // Domains
        $s5 = "globalfileshareplatform.com" ascii wide nocase  // Domains
        $s6 = "goshshare.online" ascii wide nocase  // Domains
        $s7 = "heritiage.org" ascii wide nocase  // Domains
        $s8 = "heritiages.org" ascii wide nocase  // Domains
        $s9 = "msfile.online" ascii wide nocase  // Domains
        $s10 = "mypublicshare.com" ascii wide nocase  // Domains
        $s11 = "onecloudfilesync.com" ascii wide nocase  // Domains
        $s12 = "publicsharefile.cloud" ascii wide nocase  // Domains
        $s13 = "quickfly.online" ascii wide nocase  // Domains
        $s14 = "sharehub.space" ascii wide nocase  // Domains
        $s15 = "shinjirou.info" ascii wide nocase  // Domains
        $s16 = "smartsyncbox.com" ascii wide nocase  // Domains
        $s17 = "synchvault.co" ascii wide nocase  // Domains
        $s18 = "tw-koryu.org" ascii wide nocase  // Domains
        $s19 = "winsync.cloud" ascii wide nocase  // Domains
        $s20 = "108.61.163.187" ascii wide nocase  // IPv4
        $s21 = "hcrediker@mail.com" ascii wide nocase  // Email Addresses
        $s22 = "hcrediker@outlook.com" ascii wide nocase  // Email Addresses
    condition:
        any of ($s*) or
        hash.sha256(0, filesize) == "b314a1499cd728ca3e54b7150661fd0c7d2279065fe3f570f0f66c395d744460"
}