import "hash"

rule bulwark_https_bulwarkblack_com_teams_helpdesk_impersonation_remote_support_guardrails
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/teams-helpdesk-impersonation-remote-support-guardrails/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-27T00:00:00Z"
        tlp = "TLP:CLEAR"
        indicator_count = "14"
    strings:
        $s0 = "dssdfvsdfvsdfvsdgbfbdvdzv.org" ascii wide nocase  // Domains
        $s1 = "synctimes.australiaeast.cloudapp.azure.com" ascii wide nocase  // Domains
        $s2 = "update1n5.blob.core.windows.net" ascii wide nocase  // Domains
        $s3 = "update1n6.blob.core.windows.net" ascii wide nocase  // Domains
        $s4 = "update1n7.blob.core.windows.net" ascii wide nocase  // Domains
        $s5 = "update1n9.blob.core.windows.net" ascii wide nocase  // Domains
        $s6 = "updatetmp.blob.core.windows.net" ascii wide nocase  // Domains
        $s7 = "webwether.eastus.cloudapp.azure.com" ascii wide nocase  // Domains
    condition:
        any of ($s*) or
        hash.sha256(0, filesize) == "0d2fc28af246f62f27e49207d1f64e236ad9ea029412b27877d1ae6c098e86e3" or
        hash.sha256(0, filesize) == "4cfdcae6dd1d6d98b870c8f0654d504f2bf10479a117dc297de789c249dc389d" or
        hash.sha256(0, filesize) == "69e10e0cb7bb2137ebea12971adb02c662cf5543a4f8c9530812bcbf7b183a23" or
        hash.sha256(0, filesize) == "a135fe4df18c711097e69b4f27ea32a74a955160bf2fb12da841f21866d95d87" or
        hash.sha256(0, filesize) == "a4d145a6347e47d40b3ca48af5c6dba01bf019d0110e31a44bb70fc77d1d1676" or
        hash.sha256(0, filesize) == "cc6d0f3f47afeba018173604e34f527e8413d3a54ffb35caed529bff49055ec5"
}