import "hash"

rule bulwark_https_bulwarkblack_com_100_days_of_yara_2023
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/100-days-of-yara-2023/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-07-15T22:29:56Z"
        tlp = "TLP:CLEAR"
        indicator_count = "36"
    strings:
        $s0 = "ci.appveyor.com" ascii wide nocase  // Domains
        $s1 = "community.spiceworks.com" ascii wide nocase  // Domains
        $s2 = "export.name" ascii wide nocase  // Domains
        $s3 = "interoperability.blob.core.windows.net" ascii wide nocase  // Domains
        $s4 = "osandamalith.com" ascii wide nocase  // Domains
        $s5 = "redmaple.tech" ascii wide nocase  // Domains
        $s6 = "section.name" ascii wide nocase  // Domains
        $s7 = "www.garykessler.net" ascii wide nocase  // Domains
        $s8 = "www.tarlogic.com" ascii wide nocase  // Domains
        $s9 = "https://ci.appveyor.com/project/plusvic/yara/build/job/wthlb30bklmlns0a/artifacts" ascii wide nocase  // URLs
        $s10 = "https://community.spiceworks.com/topic/2107142-what-are-all-of-the-file-types-on-a-windows-pc-that-contain-executable-code" ascii wide nocase  // URLs
        $s11 = "https://interoperability.blob.core.windows.net/files/MS-ONE/%5bMS-ONE%5d.pdf" ascii wide nocase  // URLs
        $s12 = "https://osandamalith.com/2020/07/19/exploring-the-ms-dos-stub/" ascii wide nocase  // URLs
        $s13 = "https://redmaple.tech/blogs/macho-files/" ascii wide nocase  // URLs
        $s14 = "https://www.garykessler.net/library/file_sigs.html" ascii wide nocase  // URLs
        $s15 = "https://www.tarlogic.com/blog/seloaddriverprivilege-privilege-escalation/" ascii wide nocase  // URLs
    condition:
        any of ($s*) or
        hash.md5(0, filesize) == "269af2751efee65b1ab00622816c83e6" or
        hash.md5(0, filesize) == "30851d4a2b31e9699084a06e765e21b0" or
        hash.md5(0, filesize) == "4f6b9c644d4fe517889b3fbb0b4271ca" or
        hash.md5(0, filesize) == "72f60d7f4ce22db4506547ad555ea0b1" or
        hash.md5(0, filesize) == "c0de41e45352714500771d43f0d8c4c3" or
        hash.md5(0, filesize) == "f34d5f2d4577ed6d9ceec516c1f5a744" or
        hash.sha1(0, filesize) == "05ef26965be930fade49e5dcba73b9fefc04757e" or
        hash.sha1(0, filesize) == "2b631d0ee47650923955398921c1ceccc3e38cb1" or
        hash.sha256(0, filesize) == "003669761229d3e1db0f5a5b333ef62b3dffcc8e27c821ce9018362e0a2df7e9" or
        hash.sha256(0, filesize) == "1db32411a88725b259a7f079bdebd5602f11130f71ec35bec9d18134adbd4352" or
        hash.sha256(0, filesize) == "2218904238dc4f8bb5bb838ed4fa779f7873814d7711a28ba59603826ae020aa" or
        hash.sha256(0, filesize) == "5904bc90aec64b12caa5d352199bd4ec2f5a3a9ac0a08adf954689a58eff3f2a" or
        hash.sha256(0, filesize) == "76d54a57bf9521f6558b588acd0326249248f91b27ebc25fd94ebe92dc497809" or
        hash.sha256(0, filesize) == "a37a290863fe29b9812e819e4c5b047c44e7a7d7c40e33da6f5662e1957862ab" or
        hash.sha256(0, filesize) == "a44b35f376f6e493580c988cd697e8a2d64c82ab665dfd100115fb6f700bb82a" or
        hash.sha256(0, filesize) == "b7d217f13550227bb6d80d05bde26e43cd752a870973052080a72a510c444b5a" or
        hash.sha256(0, filesize) == "c98ac83685cb5f7f72e832998fec753910e77d1b8eee638acb508252912f6cf6" or
        hash.sha256(0, filesize) == "eb30a1822bd6f503f8151cb04bfd315a62fa67dbfe1f573e6fcfd74636ecedd5" or
        hash.sha256(0, filesize) == "ed48d56a47982c3c9b39ee8859e0b764454ab9ac6e7a7866cdef5c310521be19" or
        hash.sha256(0, filesize) == "f119cc4cb5a7972bdc80548982b2b63fac5b48d5fce1517270db67c858e9e8b0"
}