rule bulwark_https_bulwarkblack_com_ai_powered_attack_achieves_aws_admin_access_in_under_10_minutes_a
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/ai-powered-attack-achieves-aws-admin-access-in-under-10-minutes-a-new-era-of-automated-intrusions/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-07-15T22:30:02Z"
        tlp = "TLP:CLEAR"
        indicator_count = "20"
    strings:
        $s0 = "download.pytorch.org" ascii wide nocase  // Domains
        $s1 = "terraform-bedrock-deploy.tf" ascii wide nocase  // Domains
        $s2 = "103.177.183.165" ascii wide nocase  // IPv4
        $s3 = "104.155.129.177" ascii wide nocase  // IPv4
        $s4 = "104.155.178.59" ascii wide nocase  // IPv4
        $s5 = "104.197.169.222" ascii wide nocase  // IPv4
        $s6 = "136.113.159.75" ascii wide nocase  // IPv4
        $s7 = "152.58.47.83" ascii wide nocase  // IPv4
        $s8 = "194.127.167.92" ascii wide nocase  // IPv4
        $s9 = "197.51.170.131" ascii wide nocase  // IPv4
        $s10 = "204.152.223.172" ascii wide nocase  // IPv4
        $s11 = "34.171.37.34" ascii wide nocase  // IPv4
        $s12 = "34.173.176.171" ascii wide nocase  // IPv4
        $s13 = "34.30.49.235" ascii wide nocase  // IPv4
        $s14 = "34.63.142.34" ascii wide nocase  // IPv4
        $s15 = "34.66.36.38" ascii wide nocase  // IPv4
        $s16 = "34.69.200.125" ascii wide nocase  // IPv4
        $s17 = "34.9.139.206" ascii wide nocase  // IPv4
        $s18 = "35.188.114.132" ascii wide nocase  // IPv4
        $s19 = "35.192.38.204" ascii wide nocase  // IPv4
    condition:
        any of ($s*)
}