import "hash"

rule bulwark_https_bulwarkblack_com_terminalfix_fake_captcha_reverse_tunnel_defense
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/terminalfix-fake-captcha-reverse-tunnel-defense/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-29T20:03:45Z"
        tlp = "TLP:CLEAR"
        indicator_count = "16"
    strings:
        $s0 = "bestsocialmedianewspapper.com" ascii wide nocase  // Domains
        $s1 = "gitnow.dev" ascii wide nocase  // Domains
        $s2 = "linked-log.com" ascii wide nocase  // Domains
        $s3 = "offlineupdater.com" ascii wide nocase  // Domains
        $s4 = "https://linked-log.com/" ascii wide nocase  // URLs
    condition:
        any of ($s*) or
        hash.sha256(0, filesize) == "026478003fe354134c03acf6890e7d3b153ba08a836eca42350db48f213872ab" or
        hash.sha256(0, filesize) == "032b529fac61e550f5dc9489686f519b82d64625fa05a8d9ecf8ba8be9b2ad22" or
        hash.sha256(0, filesize) == "18c2090e8a0ae0568af9b87e59eaf8270f23d2909600ed9db91a9444fd8b278f" or
        hash.sha256(0, filesize) == "342df92235c9dec81203b837addaa38bb85b64b4a48fe71b5303ca86d991991e" or
        hash.sha256(0, filesize) == "5d43abf5c36ea203176d3300ff14af27b4be81810ad2679b3a62b255e3d6e1c8" or
        hash.sha256(0, filesize) == "9a7b4dcd51d9251c177d323d6aaecdfc86674f69bc1af048dc872926d22aaa24" or
        hash.sha256(0, filesize) == "b8d107800403b9197e5b7609ceacd8e4cac1b0f9a1d156e6dacd6c3f7794b36a" or
        hash.sha256(0, filesize) == "ba77feed86bcda49308746421bdc684a432dd5d68c363975b2a3c6831bda3f07" or
        hash.sha256(0, filesize) == "df8221a933b38284ebdcb8bffc2df62123c9f5b5f421dd0b070e13e668b3eabf" or
        hash.sha256(0, filesize) == "eb1b4be34d05b394fb74efdeb95faecd1d1963be6ecc1b9db2b4757b491f01f0" or
        hash.sha256(0, filesize) == "ededeacf30e493dd632d477fe770ba419aa2848f685ea049381a0a8d2cc3e84d"
}