import "hash"

rule bulwark_https_bulwarkblack_com_trojanized_terraform_provider_iac_pipeline_defense
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/trojanized-terraform-provider-iac-pipeline-defense/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-10-11T01:04:31Z"
        tlp = "TLP:CLEAR"
        indicator_count = "28"
    strings:
        $s0 = "arusupport-region1-webhook.online" ascii wide nocase  // Domains
        $s1 = "delay.servehttp.com" ascii wide nocase  // Domains
        $s2 = "diagnose.hashicorp-terraform.io" ascii wide nocase  // Domains
        $s3 = "hashicorp-terraform.io" ascii wide nocase  // Domains
        $s4 = "pastebin.com" ascii wide nocase  // Domains
        $s5 = "raw.githubusercontent.com" ascii wide nocase  // Domains
        $s6 = "serveftp.com" ascii wide nocase  // Domains
        $s7 = "stage-fashion365.vercel.app" ascii wide nocase  // Domains
        $s8 = "supportaru.serveftp.com" ascii wide nocase  // Domains
        $s9 = "vercel.app" ascii wide nocase  // Domains
        $s10 = "https://arusupport-region1-webhook.online/statics/cache/v11/abicfjej" ascii wide nocase  // URLs
        $s11 = "https://diagnose.hashicorp-terraform.io/plugins/grpc/v6/schema/metrics/333afe63-c5a2-43f0-b046-7cbaa7797e8a" ascii wide nocase  // URLs
        $s12 = "https://pastebin.com/raw/3yptBDhL" ascii wide nocase  // URLs
        $s13 = "https://raw.githubusercontent.com/bluearuhost/hospitalrun-frontend/refs/heads/main/public/fonts/version1/" ascii wide nocase  // URLs
        $s14 = "https://stage-fashion365.vercel.app/static/tinymce4.7.5/plugins/fonts/v1104/" ascii wide nocase  // URLs
        $s15 = "https://supportaru.serveftp.com/statics/cache/v11/" ascii wide nocase  // URLs
    condition:
        any of ($s*) or
        hash.md5(0, filesize) == "116f7189ed7b41f1b339a749d56e63be" or
        hash.md5(0, filesize) == "2621753691be9521288664bb551dfba6" or
        hash.md5(0, filesize) == "2b81aceab0142472d94eb42e500b27b1" or
        hash.md5(0, filesize) == "34a52e6a4d803e94fe497bab682abfd3" or
        hash.md5(0, filesize) == "3826dc7a9ba8bd5b1c143560c1530d89" or
        hash.md5(0, filesize) == "4b8509cde757b5428e5f99c8dffe73ca" or
        hash.md5(0, filesize) == "58fa0d651898446d5f5d2ed8a27a3330" or
        hash.md5(0, filesize) == "73adaea97f003735335505858c1c6def" or
        hash.md5(0, filesize) == "9d78ece09457907b730d139e4e0c64dd" or
        hash.md5(0, filesize) == "9d88b4494c7bc27b10358b68a899ad54" or
        hash.md5(0, filesize) == "ad0b1b6d2c8b9d09d6473a4a299470ab" or
        hash.md5(0, filesize) == "be60c52ca8a01fef7dc15c2f0ebb77d8"
}