import "hash"

rule bulwark_https_bulwarkblack_com_uat11587_antino_m365_c2_cloud_detection
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/uat11587-antino-m365-c2-cloud-detection/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-10-03T01:05:45Z"
        tlp = "TLP:CLEAR"
        indicator_count = "157"
    strings:
        $s0 = "d2nq35tel3ucuo.cloudfront.net" ascii wide nocase  // Domains
        $s1 = "d32tpl7xt7175h.cloudfront.net" ascii wide nocase  // Domains
        $s2 = "login.microsoftonline.com" ascii wide nocase  // Domains
        $s3 = "microsoft-flash.com" ascii wide nocase  // Domains
        $s4 = "my-3lyt6wcp.pages.dev" ascii wide nocase  // Domains
        $s5 = "my-662ylt3w.pages.dev" ascii wide nocase  // Domains
        $s6 = "my-6g16qsfe.pages.dev" ascii wide nocase  // Domains
        $s7 = "my-goq6xmbm.pages.dev" ascii wide nocase  // Domains
        $s8 = "my-h3qli6kq.pages.dev" ascii wide nocase  // Domains
        $s9 = "my-qc39r814.pages.dev" ascii wide nocase  // Domains
        $s10 = "my-sv7c1fzs.pages.dev" ascii wide nocase  // Domains
        $s11 = "my-u0up9qri.pages.dev" ascii wide nocase  // Domains
        $s12 = "my-vtsdod2n.pages.dev" ascii wide nocase  // Domains
        $s13 = "my-wgoxp32b.pages.dev" ascii wide nocase  // Domains
        $s14 = "oisadjfoinsiduhfnoisdnfosdnoifnsoid.pages.dev" ascii wide nocase  // Domains
        $s15 = "osc-cdn.com" ascii wide nocase  // Domains
        $s16 = "page.dev" ascii wide nocase  // Domains
        $s17 = "pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev" ascii wide nocase  // Domains
        $s18 = "pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev" ascii wide nocase  // Domains
        $s19 = "r2.dev" ascii wide nocase  // Domains
        $s20 = "rsproxy.cn" ascii wide nocase  // Domains
        $s21 = "wps-cn.com" ascii wide nocase  // Domains
        $s22 = "www.wps-cn.com" ascii wide nocase  // Domains
        $s23 = "http://d2nq35tel3ucuo.cloudfront.net/4oyE4n4ozLQ0.log" ascii wide nocase  // URLs
        $s24 = "http://d2nq35tel3ucuo.cloudfront.net/LtVGUSsyUTDA.log" ascii wide nocase  // URLs
        $s25 = "http://d2nq35tel3ucuo.cloudfront.net/TzzyYlYnJ40Z.log" ascii wide nocase  // URLs
        $s26 = "http://d2nq35tel3ucuo.cloudfront.net/tdyvHHVcrci8.log" ascii wide nocase  // URLs
        $s27 = "http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/5SVIdjpRQjkZ" ascii wide nocase  // URLs
        $s28 = "http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/5TGrbjCCLa8M" ascii wide nocase  // URLs
        $s29 = "http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/5U7kzhvlYlVF" ascii wide nocase  // URLs
        $s30 = "http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/6HJV5qV5BTLs" ascii wide nocase  // URLs
        $s31 = "http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/BKvYRxPiGpbM" ascii wide nocase  // URLs
        $s32 = "http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/HenUWB51MwpG" ascii wide nocase  // URLs
        $s33 = "http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/MKJacn3hFt3Y" ascii wide nocase  // URLs
        $s34 = "http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/PbyfSk69AwVf" ascii wide nocase  // URLs
        $s35 = "http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/byrdvvZEZZlk" ascii wide nocase  // URLs
        $s36 = "http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/cX8MChhuVvzz" ascii wide nocase  // URLs
        $s37 = "http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/icWMOGLJcfQO" ascii wide nocase  // URLs
        $s38 = "http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/nswz3cb9lhuC" ascii wide nocase  // URLs
        $s39 = "http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/q9LgxIaU1CJK" ascii wide nocase  // URLs
        $s40 = "http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/qMD71Z95clTf" ascii wide nocase  // URLs
        $s41 = "http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/s0p18dgHR4PZ" ascii wide nocase  // URLs
        $s42 = "http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/zlKDeyO3HuUS" ascii wide nocase  // URLs
        $s43 = "http://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/Qw7Womin4X6N" ascii wide nocase  // URLs
        $s44 = "http://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/kVFPxm1uAjOY" ascii wide nocase  // URLs
        $s45 = "https://d2nq35tel3ucuo.cloudfront.net/9q9OlLKCm0an2ct1.js" ascii wide nocase  // URLs
        $s46 = "https://d2nq35tel3ucuo.cloudfront.net/HsOw0YU9s11dxyr1.txt" ascii wide nocase  // URLs
        $s47 = "https://d2nq35tel3ucuo.cloudfront.net/LwqPW64Xl0ti3q7s.txt" ascii wide nocase  // URLs
        $s48 = "https://microsoft-flash.com/download/flashcenter_pp_ax_install_en.exe" ascii wide nocase  // URLs
        $s49 = "https://my-662ylt3w.pages.dev/Institutional_Disciplinary_Action_Report_May_2026.hta" ascii wide nocase  // URLs
        $s50 = "https://my-662ylt3w.pages.dev/Institutional_Disciplinary_Action_Report_May_2026.wsf" ascii wide nocase  // URLs
        $s51 = "https://my-6g16qsfe.pages.dev/the%20May%2027%20inauguration%20of%20the%20TPiE.hta" ascii wide nocase  // URLs
        $s52 = "https://my-6g16qsfe.pages.dev/the%20May%2027%20inauguration%20of%20the%20TPiE.wsf" ascii wide nocase  // URLs
        $s53 = "https://my-goq6xmbm.pages.dev/Tehran_Bilateral_Summit_Proceedings_May2026.hta" ascii wide nocase  // URLs
        $s54 = "https://my-goq6xmbm.pages.dev/Tehran_Bilateral_Summit_Proceedings_May2026.wsf" ascii wide nocase  // URLs
        $s55 = "https://my-h3qli6kq.pages.dev/CrossBorder_Repression_Seminar_Agenda.hta" ascii wide nocase  // URLs
        $s56 = "https://my-h3qli6kq.pages.dev/CrossBorder_Repression_Seminar_Agenda.wsf" ascii wide nocase  // URLs
        $s57 = "https://my-sv7c1fzs.pages.dev/Extravaganza%20Latin%20Carnival.hta" ascii wide nocase  // URLs
        $s58 = "https://my-sv7c1fzs.pages.dev/Extravaganza%20Latin%20Carnival.wsf" ascii wide nocase  // URLs
        $s59 = "https://my-u0up9qri.pages.dev/UO%20-C-DAC%20%281%29.hta" ascii wide nocase  // URLs
        $s60 = "https://my-u0up9qri.pages.dev/UO%20-C-DAC%20%281%29.wsf" ascii wide nocase  // URLs
        $s61 = "https://my-vtsdod2n.pages.dev/Extravaganza%20Latin%20Carnival%20post%20copy.hta" ascii wide nocase  // URLs
        $s62 = "https://my-vtsdod2n.pages.dev/Extravaganza%20Latin%20Carnival%20post%20copy.wsf" ascii wide nocase  // URLs
        $s63 = "https://my-wgoxp32b.pages.dev/Internal_Review_Dossier_0520.hta" ascii wide nocase  // URLs
        $s64 = "https://my-wgoxp32b.pages.dev/Internal_Review_Dossier_0520.wsf" ascii wide nocase  // URLs
        $s65 = "https://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/7ChyKauxbnuftp68.js" ascii wide nocase  // URLs
        $s66 = "https://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/AcPP9fCvdjztmho8.txt" ascii wide nocase  // URLs
        $s67 = "https://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/KOOOT4a76st012bx.txt" ascii wide nocase  // URLs
        $s68 = "https://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/Ub4RJzNIrfleri8t.txt" ascii wide nocase  // URLs
        $s69 = "https://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/VD7F3WxnGatherOsState.exe.mtm" ascii wide nocase  // URLs
        $s70 = "https://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/VD7F3WxnOsState.dat.pgy" ascii wide nocase  // URLs
        $s71 = "https://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/VD7F3Wxnslc.dll.fsc" ascii wide nocase  // URLs
        $s72 = "https://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/bzP3NcRPGatherOsState.exe.thl" ascii wide nocase  // URLs
        $s73 = "https://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/bzP3NcRPOsState.dat.mxb" ascii wide nocase  // URLs
        $s74 = "https://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/bzP3NcRPslc.dll.czh" ascii wide nocase  // URLs
        $s75 = "https://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/oaFE7PJHk0h_emqt.txt" ascii wide nocase  // URLs
        $s76 = "https://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/vD68BdmB2ky28gcc.js" ascii wide nocase  // URLs
        $s77 = "https://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/0u25lAqY58or53ra.js" ascii wide nocase  // URLs
        $s78 = "https://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/2laZiB2zvnx04jze.js" ascii wide nocase  // URLs
        $s79 = "https://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/8ypvQLxJvggmrz94.txt" ascii wide nocase  // URLs
        $s80 = "https://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/HeiqAW6ZGatherOsState.exe.luy" ascii wide nocase  // URLs
        $s81 = "https://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/HeiqAW6ZOsGather.dat.syk" ascii wide nocase  // URLs
        $s82 = "https://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/HeiqAW6Zslc.dll.pzs" ascii wide nocase  // URLs
        $s83 = "https://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/HzjNPgRE9ir92e38.txt" ascii wide nocase  // URLs
        $s84 = "https://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/ThyI9pwewrh_a1pr.txt" ascii wide nocase  // URLs
        $s85 = "https://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/gpv0IRMtvto6e8t2.txt" ascii wide nocase  // URLs
        $s86 = "https://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/hjgzBskgGatherOsState.exe.lzj" ascii wide nocase  // URLs
        $s87 = "https://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/hjgzBskgOsGather.dat.ael" ascii wide nocase  // URLs
        $s88 = "https://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/hjgzBskgslc.dll.iwq" ascii wide nocase  // URLs
        $s89 = "https://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/wyLwwCu43j1wf2pg.js" ascii wide nocase  // URLs
        $s90 = "https://www.wps-cn.com/downloads/flashcenter_pp_ax_install_en.exe" ascii wide nocase  // URLs
        $s91 = "103.27.110.220" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.md5(0, filesize) == "0173d1566dcd4fd49fa25f11f14bfe4c" or
        hash.md5(0, filesize) == "abfa7742e315485a98a5fafd6dbfb68e" or
        hash.sha256(0, filesize) == "01b5c6acb20e41799a0e96d9d1d6e1c44791883706b6285e874fcb15cc93b31a" or
        hash.sha256(0, filesize) == "077bd873217d8abfbb6482d11966ca34f3fef7ad5166f24fbc5dc3ddefe894a1" or
        hash.sha256(0, filesize) == "079acd58a74479ac8b108b618d2a4da8a8bd560a04459cd90e2fec9da5027513" or
        hash.sha256(0, filesize) == "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff" or
        hash.sha256(0, filesize) == "0a6fb71ab1362d065c7ec2678c1e73d9a0721b0e7099d392ba7559bb2eec4970" or
        hash.sha256(0, filesize) == "0b4e5e017c0f0ccac79e13ca5d580a75af67a24ca0763f9ebfdaaeb1ba4fc739" or
        hash.sha256(0, filesize) == "0c39264337a1186b2e765e24073399cbdcba118306614eb411e315887af578bd" or
        hash.sha256(0, filesize) == "131ac3e0df777910e0a32e43d5744bccb0490750d4c2adc359da41d76d383c46" or
        hash.sha256(0, filesize) == "133a46ba41136ca21c93fb08c28446826d8c0d9b7923a16f2d152d595a710098" or
        hash.sha256(0, filesize) == "170b0eee60a335f32c1d0c19a0bb8d8bbc0a5b298ea9486b546f58d25cc8a464" or
        hash.sha256(0, filesize) == "17b53ffa8e005f0e82491d3f9c0a4984c44da52e1668a855c11a137f627c5b4b" or
        hash.sha256(0, filesize) == "1fadc90b61ce536abda78eb387a7f3d745f00c16775d3f762845ccc0fde567da" or
        hash.sha256(0, filesize) == "23d5f1af8581ae200615d9a66d539f2043c3248b649e862557b379d7e8b7a3ac" or
        hash.sha256(0, filesize) == "2f1513c822af0c6635dd3c69dc38f0b2f6e02012ea36415fff111a5d4d5fae05" or
        hash.sha256(0, filesize) == "334f39279ff3aae40fe74340c887ae018c75bc42790586bdf9070adb5889100c" or
        hash.sha256(0, filesize) == "3a4c9020eeb5ef22a1ff443e606ccb6705fe287c583121c713d2c9f9f1f2a2af" or
        hash.sha256(0, filesize) == "3a94910eb8022592ce030e6861359f7e980fc1b5a6ccd290cbb071d3e95ed02a" or
        hash.sha256(0, filesize) == "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d" or
        hash.sha256(0, filesize) == "47f98dfe01759a464e22d5ec55d012dccb38ce010dd73e3ba8d7ffefca12b4b2" or
        hash.sha256(0, filesize) == "484ab497072ea09f12187b349f5b1c80754e4942408a009cccb20a2a3c8c6506" or
        hash.sha256(0, filesize) == "4b614e5c37abaddca162119e42a969945caa681305e246e0ed0060ea9984008b" or
        hash.sha256(0, filesize) == "4d0fdce4c098635fe9b296c3a82c74645f9885eb5e383aa44a0fe7e50da3ca3f" or
        hash.sha256(0, filesize) == "5168a2696a0ed858f996f388bfe94f952d475158f4ee6206816608936db005ca" or
        hash.sha256(0, filesize) == "5555e904101689351a2a1359c9c06da0a57139a9470df7d26823c1b75db55041" or
        hash.sha256(0, filesize) == "5a35fcd4458e808ab0fa52bb2a92923b60566ee4d7aaadaac7c95cad3d839562" or
        hash.sha256(0, filesize) == "5c5c060b272cd4a5c3767edc0e9478bd35b7e1756e183d0446a5491bd65519cb" or
        hash.sha256(0, filesize) == "61a8f5add6c35f99c389012dbb2343061fd0b54611b40490b9a7f0b49d707da0" or
        hash.sha256(0, filesize) == "65f4b9292e91abfa5adf42a03526932930c1c0a436bb186a7948fe6770295788" or
        hash.sha256(0, filesize) == "6a1dbbfcfe6867ac83d35012b2717084388b4a34707efd0b725466dfd0e8fa56" or
        hash.sha256(0, filesize) == "747b1d13bdf06956b5da5f47250fefd5284ebcf7961971732c3d348aa1a2d533" or
        hash.sha256(0, filesize) == "75c12795016ae48b1bddd34a9f5adea63a12f58701eae01e1b4ab3d9dfa1513c" or
        hash.sha256(0, filesize) == "7969ae5f11fc163049c8eadba06f814f5edece13a707e6087c1c49011a45b838" or
        hash.sha256(0, filesize) == "7c2ac9c040b3300bffa7d2e435dbb1bc12e7efd644d2216d603c72121266395c" or
        hash.sha256(0, filesize) == "7fa98efba59614cec0b7291aedee98764f8dc037b6cc798c93951a31208e9e32" or
        hash.sha256(0, filesize) == "8e1d68906d6de92f359945d3a95da1480e72773a3e8dea7682d6bf0f6699f75f" or
        hash.sha256(0, filesize) == "971cb2448b5d67dcc1f5eaa10d12e77f213035ad31230dc2ac7a510610a2059d" or
        hash.sha256(0, filesize) == "9b7df409c9a89f7536d3ba7b6d43fb6dbac618c8bb52615ba34cc971ad71bbf3" or
        hash.sha256(0, filesize) == "9fc50cf28f86201fda8306926817b1ede41fdd993202515905dd072f6803542f" or
        hash.sha256(0, filesize) == "a0e91085f08956a9a7034ace73cee60cb211f5d96f02bc91a026601bde8f2221" or
        hash.sha256(0, filesize) == "a13182699a12a8dd9d07c336dbd8de5e9b086b9b09793b7de2e9761aa03ce1dc" or
        hash.sha256(0, filesize) == "ad0bd2b45e2416fb1384bf30af068d857e7c06b4226615d66b55b610a34c5670" or
        hash.sha256(0, filesize) == "ae1b45fb56b9f1b9cb3ee30d2bb1279c9b90b70bb62f8de305d198c6a4e0585e" or
        hash.sha256(0, filesize) == "aea5e9029f9212d05bde10f7806d1f2819be45d167e6fd877b9fb1b11088ac90" or
        hash.sha256(0, filesize) == "b31ca75f73a9363b0e35042a41216c3f581eaa0b9cd78cb58f089c2e40babd40" or
        hash.sha256(0, filesize) == "b3416726a064dd7f657bbb400adeb365eea7f8bb60783ad2d9da1a1d93768731" or
        hash.sha256(0, filesize) == "b75492466462141c56d97b705f0c606faf272577631dc2822aa8d6bda53633b6" or
        hash.sha256(0, filesize) == "b8e6e83a73e6e07f8873c364dd2a4b830bceb60758163e2efcd7e387cb604655" or
        hash.sha256(0, filesize) == "b90a4e770869c28fd2140acb3ebdc50c113bb6f096b4bbdb9ac87c349c70e85e" or
        hash.sha256(0, filesize) == "bd8ddc8f33e0fe43147ee6f1713654996420a27c5d2cd91751ad67124ebc6fe4" or
        hash.sha256(0, filesize) == "c8e1239d7276178b6620f47ec4880494be1cb394477b223fc54bffb0947bff50" or
        hash.sha256(0, filesize) == "ca14ad0344dc7216f6da29a5cbe4237d886cc5257e8c3a48fb4885a311c9b800" or
        hash.sha256(0, filesize) == "cd3509fa82e506cc6f2eeafa0a45d4b8b76a07edadd29779daf00568febcaba7" or
        hash.sha256(0, filesize) == "d4cb2f5df16ec9b9c5b796ae55848534e15d4f8b8806f0431108fc7a99a2548a" or
        hash.sha256(0, filesize) == "d753a615aedf8e58ffc75b2b7ebd320c0cbe6bcb5cbb885db749a2a85c55d3bf" or
        hash.sha256(0, filesize) == "d87201c1299a7f5854929645e6891c6c424d2a690031272bedacba7c5fe73a3e" or
        hash.sha256(0, filesize) == "e2eb7703047b37b28dc34e6990205d758a2454b39bc655b460606745fadcb530" or
        hash.sha256(0, filesize) == "e2f59d8d5a81583ed482b6c7bf37699efdb2264e452cf7d8cfc0c54dfbd9ab3f" or
        hash.sha256(0, filesize) == "e6ff096a0562c0042b09d250bd60272ffcd8d72bd95c563842acf765a8dc8bcf" or
        hash.sha256(0, filesize) == "e7e3b0bcd6798634adf8b49d305f3a7b7682e4b76db549682a183c5a186df4bb" or
        hash.sha256(0, filesize) == "e809da86bd81463347fa7f922d3e088755a94a331889d32acb55aa8f57778a34" or
        hash.sha256(0, filesize) == "f0c1dc6d6daa4d010932c7818ed5f22929c182f58e5f495fabe2fb3cfc835b97" or
        hash.sha256(0, filesize) == "f1ef5fe4c0cdcff13cc750c867728b89719f81437bdc49041edd1ae1f3edb4e8" or
        hash.sha256(0, filesize) == "fdbd047031c13a17c9f491c9355f44d587584ebe2b8927be8482e6c236c8e1c1"
}