import "hash"

rule bulwark_https_bulwarkblack_com_xcsset_v40_xcode_developer_mac_supply_chain_defense
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/xcsset-v40-xcode-developer-mac-supply-chain-defense/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-27T05:26:56Z"
        tlp = "TLP:CLEAR"
        indicator_count = "80"
    strings:
        $s0 = "accapple.ru" ascii wide nocase  // Domains
        $s1 = "adschecks.ru" ascii wide nocase  // Domains
        $s2 = "adsmobi.ru" ascii wide nocase  // Domains
        $s3 = "adsmorein.in" ascii wide nocase  // Domains
        $s4 = "adsmoreme.in" ascii wide nocase  // Domains
        $s5 = "amdcdn.ru" ascii wide nocase  // Domains
        $s6 = "amzndev.in" ascii wide nocase  // Domains
        $s7 = "amzndev.ru" ascii wide nocase  // Domains
        $s8 = "amznprod.in" ascii wide nocase  // Domains
        $s9 = "applecdn.ru" ascii wide nocase  // Domains
        $s10 = "appledisk.ru" ascii wide nocase  // Domains
        $s11 = "appledns.ru" ascii wide nocase  // Domains
        $s12 = "applehosts.ru" ascii wide nocase  // Domains
        $s13 = "appletime.in" ascii wide nocase  // Domains
        $s14 = "bulksec.ru" ascii wide nocase  // Domains
        $s15 = "cdnamz.in" ascii wide nocase  // Domains
        $s16 = "cdnamz.ru" ascii wide nocase  // Domains
        $s17 = "cdnapple.in" ascii wide nocase  // Domains
        $s18 = "cdnatapple.ru" ascii wide nocase  // Domains
        $s19 = "cdnroute.ru" ascii wide nocase  // Domains
        $s20 = "checkcdn.ru" ascii wide nocase  // Domains
        $s21 = "chromeads.ru" ascii wide nocase  // Domains
        $s22 = "cnmag.ru" ascii wide nocase  // Domains
        $s23 = "devnetaps.ru" ascii wide nocase  // Domains
        $s24 = "dnsapple.ru" ascii wide nocase  // Domains
        $s25 = "dnsrelays.ru" ascii wide nocase  // Domains
        $s26 = "explorecdn.ru" ascii wide nocase  // Domains
        $s27 = "fiddlejoy.ru" ascii wide nocase  // Domains
        $s28 = "figmacat.ru" ascii wide nocase  // Domains
        $s29 = "figmanets.in" ascii wide nocase  // Domains
        $s30 = "funchats.ru" ascii wide nocase  // Domains
        $s31 = "gironetcdn.ru" ascii wide nocase  // Domains
        $s32 = "goalmate.ru" ascii wide nocase  // Domains
        $s33 = "googlenets.ru" ascii wide nocase  // Domains
        $s34 = "greencn.ru" ascii wide nocase  // Domains
        $s35 = "icloudsnet.ru" ascii wide nocase  // Domains
        $s36 = "imails.ru" ascii wide nocase  // Domains
        $s37 = "legalads.in" ascii wide nocase  // Domains
        $s38 = "littleads.in" ascii wide nocase  // Domains
        $s39 = "littledns.ru" ascii wide nocase  // Domains
        $s40 = "maganet.ru" ascii wide nocase  // Domains
        $s41 = "mindelgate.ru" ascii wide nocase  // Domains
        $s42 = "netapsdev.ru" ascii wide nocase  // Domains
        $s43 = "netcdnads.in" ascii wide nocase  // Domains
        $s44 = "netcdnamz.ru" ascii wide nocase  // Domains
        $s45 = "netcdndev.in" ascii wide nocase  // Domains
        $s46 = "netcorps.ru" ascii wide nocase  // Domains
        $s47 = "netsprot.in" ascii wide nocase  // Domains
        $s48 = "netsproto.in" ascii wide nocase  // Domains
        $s49 = "networkads.in" ascii wide nocase  // Domains
        $s50 = "p.app" ascii wide nocase  // Domains
        $s51 = "rigacdn.in" ascii wide nocase  // Domains
        $s52 = "rigmajoys.in" ascii wide nocase  // Domains
        $s53 = "rigmanet.ru" ascii wide nocase  // Domains
        $s54 = "rigmanets.in" ascii wide nocase  // Domains
        $s55 = "sahusuzuki.in" ascii wide nocase  // Domains
        $s56 = "settings.app" ascii wide nocase  // Domains
        $s57 = "stuffdns.in" ascii wide nocase  // Domains
        $s58 = "telegram.app" ascii wide nocase  // Domains
        $s59 = "testjoys.ru" ascii wide nocase  // Domains
        $s60 = "timewebnet.in" ascii wide nocase  // Domains
        $s61 = "vigmanet.ru" ascii wide nocase  // Domains
        $s62 = "whitead.in" ascii wide nocase  // Domains
        $s63 = "whiteads.ru" ascii wide nocase  // Domains
        $s64 = "wincdn.ru" ascii wide nocase  // Domains
        $s65 = "windsecure.ru" ascii wide nocase  // Domains
        $s66 = "https://amzndev.in/d/zw_sfp64" ascii wide nocase  // URLs
        $s67 = "https://amzndev.ru/d/zw_sfp64" ascii wide nocase  // URLs
        $s68 = "https://googlenets.ru/d/zw_sfp64" ascii wide nocase  // URLs
        $s69 = "https://netcdndev.in/d/zw_sfp64" ascii wide nocase  // URLs
        $s70 = "https://whitead.in/d/zw_sfp64" ascii wide nocase  // URLs
        $s71 = "https://whiteads.ru/d/zw_sfp64" ascii wide nocase  // URLs
        $s72 = "151.243.109.188" ascii wide nocase  // IPv4
        $s73 = "178.208.92.129" ascii wide nocase  // IPv4
        $s74 = "178.208.92.168" ascii wide nocase  // IPv4
        $s75 = "91.108.106.229" ascii wide nocase  // IPv4
        $s76 = "95.142.35.206" ascii wide nocase  // IPv4
        $s77 = "95.142.35.34" ascii wide nocase  // IPv4
        $s78 = "95.142.37.159" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.sha1(0, filesize) == "6e480d648fa1b70612f5d198a66875e28847547d"
}