import "hash"

rule bulwark_https_bulwarkblack_com_toy_ghouls_hivemq_element_backdoors_protocol_monitoring
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/toy-ghouls-hivemq-element-backdoors-protocol-monitoring/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-09-05T01:07:51Z"
        tlp = "TLP:CLEAR"
        indicator_count = "7"
    strings:
        $s0 = "broker.hivemq.com" ascii wide nocase  // Domains
        $s1 = "ip-api.com" ascii wide nocase  // Domains
        $s2 = "laboo.boo" ascii wide nocase  // Domains
        $s3 = "meet.element.tw" ascii wide nocase  // Domains
        $s4 = "http://ip-api.com/json" ascii wide nocase  // URLs
    condition:
        any of ($s*) or
        hash.md5(0, filesize) == "7916c33688385525078bee504c90f359" or
        hash.md5(0, filesize) == "bfadbeee63a4f0bf19ec9deb8fa58f58"
}