import "hash"

rule bulwark_https_bulwarkblack_com_ta4922_global_hr_tax_phishing_rmm_defense
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/ta4922-global-hr-tax-phishing-rmm-defense/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-27T05:26:24Z"
        tlp = "TLP:CLEAR"
        indicator_count = "22"
    strings:
        $s0 = "aeya388.club" ascii wide nocase  // Domains
        $s1 = "nwphotoblog.com" ascii wide nocase  // Domains
        $s2 = "srt.tw" ascii wide nocase  // Domains
        $s3 = "103.214.172.33" ascii wide nocase  // IPv4
        $s4 = "154.211.86.110" ascii wide nocase  // IPv4
        $s5 = "18.139.83.110" ascii wide nocase  // IPv4
        $s6 = "206.238.115.58" ascii wide nocase  // IPv4
        $s7 = "43.156.77.97" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.sha256(0, filesize) == "0857148fb0bc4aa7adf967ede2307bdb4fc427065d5b6a6db132688a5a8e1eb8" or
        hash.sha256(0, filesize) == "2d2a251a88632f010fd9671789746908eeccaa5bc5c0a5d25e4649efe4f5b15d" or
        hash.sha256(0, filesize) == "3119cf37b8267db8a2dcd11d9a83d5237d7ef1e42388e7c9afa2831b91da8a2d" or
        hash.sha256(0, filesize) == "314f4b59535d1b783e1c20c2be00f9e30f8ed27b2e21fad06a73b47ea43279ef" or
        hash.sha256(0, filesize) == "40b41979b317406f8abc601677a3b93aaf6ef8ab8ac188b8f383735e388f13b5" or
        hash.sha256(0, filesize) == "4fcfa88fffacbce30bbe2136753c9ab5a4c092940d2406fd9d44d5118e745b9d" or
        hash.sha256(0, filesize) == "584a9448dda46bd590d7a2f86228100d2ae6e0d6d990c1a4459ed5ee28e07ae8" or
        hash.sha256(0, filesize) == "66a3836b9a17771bce2161f6b73cbc2494a91e49d6aa30d2d53711e8d10de60d" or
        hash.sha256(0, filesize) == "8c9b6542f73c5c7fe455b52f5101314407da4f65ff48e7ebf6896605e607c8d0" or
        hash.sha256(0, filesize) == "9d0a55c545c4147956db2c2667c4ed931a2875309147548b1dfdd216228f5f73" or
        hash.sha256(0, filesize) == "a648db354820ea4d02940cb1702b35974513b7aae83f6dffaacaac4ba31f9295" or
        hash.sha256(0, filesize) == "a75eab31d7ff06b6864960ad7e633be3f9730ff3d3873e4539c8f425fc632dad" or
        hash.sha256(0, filesize) == "de82998ad5fcd63deae030803388e0fb4290d6223fda82368fd25b99b823f0d2" or
        hash.sha256(0, filesize) == "e0a6a71c605d9a4076147e9537f82f79f1e1eccadc874595160aa4637ff4088c"
}