import "hash"

rule bulwark_https_bulwarkblack_com_uta0565_browser_zero_day_endpoint_correlation
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/uta0565-browser-zero-day-endpoint-correlation/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-09-24T15:05:10Z"
        tlp = "TLP:CLEAR"
        indicator_count = "22"
    strings:
        $s0 = "americanprgoress.top" ascii wide nocase  // Domains
        $s1 = "americanprogress.org" ascii wide nocase  // Domains
        $s2 = "borneobulletin.com.bn" ascii wide nocase  // Domains
        $s3 = "borneobulletins.top" ascii wide nocase  // Domains
        $s4 = "chinadigitaltimes.net" ascii wide nocase  // Domains
        $s5 = "chinadigitaltimes.top" ascii wide nocase  // Domains
        $s6 = "halal-navi.com" ascii wide nocase  // Domains
        $s7 = "halal-navi.net" ascii wide nocase  // Domains
        $s8 = "halalketak.net" ascii wide nocase  // Domains
        $s9 = "halaltak.net" ascii wide nocase  // Domains
        $s10 = "outsourcingwise.com" ascii wide nocase  // Domains
        $s11 = "outsourcingwise.net" ascii wide nocase  // Domains
        $s12 = "personclouds.com" ascii wide nocase  // Domains
        $s13 = "theconversation.com" ascii wide nocase  // Domains
        $s14 = "thecovnresation.com" ascii wide nocase  // Domains
        $s15 = "thecovnresation.net" ascii wide nocase  // Domains
        $s16 = "https://americanprgoress.top/chrome_cleanup.exe" ascii wide nocase  // URLs
        $s17 = "96.9.125.52" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.md5(0, filesize) == "177652713dad3c128bd9195abf2b7603" or
        hash.sha1(0, filesize) == "668aa5551315ab26b67118fbb29f8e4560a1e1af" or
        hash.sha256(0, filesize) == "8858ea412dc306b3558885af18006c5ca24689e8875733b5e13b3c2692e603cb" or
        hash.sha256(0, filesize) == "cbeeb7dd5e89261cde032825fd10bb80bad2e3fbf5b91fdc9137ad463ffa8f21"
}