rule bulwark_https_bulwarkblack_com_artoken_eviltokens_microsoft_365_bec_token_defense
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/artoken-eviltokens-microsoft-365-bec-token-defense/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-07-15T22:30:11Z"
        tlp = "TLP:CLEAR"
        indicator_count = "12"
    strings:
        $s0 = "clear90489058903-document.workers.dev" ascii wide nocase  // Domains
        $s1 = "dashboard-bl.pamconj.com" ascii wide nocase  // Domains
        $s2 = "mononapfp.sharepoint.com" ascii wide nocase  // Domains
        $s3 = "mononapfpcom.sharepoint.com" ascii wide nocase  // Domains
        $s4 = "sharepoint.com" ascii wide nocase  // Domains
        $s5 = "spx.pamconj.com" ascii wide nocase  // Domains
        $s6 = "https://mononapfp.sharepoint.com/:f:/document/INV-IgCx1X50pgUjR7iAjZL2fuQaAW4GfKVs6wHT3BYv9sgwW7g”" ascii wide nocase  // URLs
        $s7 = "https://mononapfpcom.sharepoint.com/:f:/g/IgAdH_aaBPMcQbtINZzC1TsLARj3dHj63MnKjvnY-QJrKEc" ascii wide nocase  // URLs
        $s8 = "pamconj.com" ascii wide nocase  // URLs
        $s9 = "sharepoint.com/:f:/document/INV-IgCx1X50pgUjR7iAjZL2fuQaAW4GfKVs6wHT3BYv9sgwW7g”" ascii wide nocase  // URLs
        $s10 = "sharepoint.com/:f:/g/IgAdH_aaBPMcQbtINZzC1TsLARj3dHj63MnKjvnY-QJrKEc" ascii wide nocase  // URLs
        $s11 = "workers.dev" ascii wide nocase  // URLs
    condition:
        any of ($s*)
}