rule bulwark_https_bulwarkblack_com_teamfiltration_service_accounts_cloud_identity_risk
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/teamfiltration-service-accounts-cloud-identity-risk/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-09-22T20:05:16Z"
        tlp = "TLP:CLEAR"
        indicator_count = "4"
    strings:
        $s0 = "cdn77.com" ascii wide nocase  // Domains
        $s1 = "datacamp.co.uk" ascii wide nocase  // Domains
        $s2 = "149.88.104.19" ascii wide nocase  // IPv4
        $s3 = "3.101.157.240" ascii wide nocase  // IPv4
    condition:
        any of ($s*)
}