rule bulwark_https_bulwarkblack_com_vault_secrets_operator_kubernetes_egress_control
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/vault-secrets-operator-kubernetes-egress-control/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-29T01:03:46Z"
        tlp = "TLP:CLEAR"
        indicator_count = "7"
    strings:
        $s0 = "cherez0ff.art" ascii wide nocase  // Domains
        $s1 = "discuss.hashicorp.com" ascii wide nocase  // Domains
        $s2 = "secrets.hashicorp.com" ascii wide nocase  // Domains
        $s3 = "https://cherez0ff.art/" ascii wide nocase  // URLs
        $s4 = "https://cherez0ff.art/blog/vault-secrets-operator-secretidpath-token-theft/" ascii wide nocase  // URLs
        $s5 = "https://discuss.hashicorp.com/t/hcsec-2026-28-vault-secrets-operator-vulnerable-to-arbitrary-file-read-via-approle-secretidpath/77645" ascii wide nocase  // URLs
        $s6 = "https://github.com/cherez0ff" ascii wide nocase  // URLs
    condition:
        any of ($s*)
}