rule bulwark_https_bulwarkblack_com_arista_velocloud_command_injection_sdwan_defense
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/arista-velocloud-command-injection-sdwan-defense/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-07-27T20:07:11Z"
        tlp = "TLP:CLEAR"
        indicator_count = "9"
    strings:
        $s0 = "www.arista.com" ascii wide nocase  // Domains
        $s1 = "https://www.arista.com/en/support/customer-support" ascii wide nocase  // URLs
        $s2 = "206.72.242.124" ascii wide nocase  // IPv4
        $s3 = "206.72.242.162" ascii wide nocase  // IPv4
        $s4 = "5.2.3.14" ascii wide nocase  // IPv4
        $s5 = "6.1.3.4" ascii wide nocase  // IPv4
        $s6 = "6.4.2.4" ascii wide nocase  // IPv4
        $s7 = "7.0.0.1" ascii wide nocase  // IPv4
        $s8 = "8.19.75.217" ascii wide nocase  // IPv4
    condition:
        any of ($s*)
}