rule bulwark_https_bulwarkblack_com_canisterworm_wiper_weaponizes_trivy_supply_chain_to_target_iran
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/canisterworm-wiper-weaponizes-trivy-supply-chain-to-target-iran/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-07-15T22:30:35Z"
        tlp = "TLP:CLEAR"
        indicator_count = "20"
    strings:
        $s0 = "championships-peoples-point-cassette.trycloudflare.com" ascii wide nocase  // Domains
        $s1 = "dl.k8s.io" ascii wide nocase  // Domains
        $s2 = "icp0.io" ascii wide nocase  // Domains
        $s3 = "investigation-launches-hearings-copying.trycloudflare.com" ascii wide nocase  // Domains
        $s4 = "souls-entire-defined-routes.trycloudflare.com" ascii wide nocase  // Domains
        $s5 = "tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0.io" ascii wide nocase  // Domains
        $s6 = "trycloudflare.com" ascii wide nocase  // Domains
        $s7 = "www.aikido.dev" ascii wide nocase  // Domains
        $s8 = "https://championships-peoples-point-cassette.trycloudflare.com" ascii wide nocase  // URLs
        $s9 = "https://championships-peoples-point-cassette.trycloudflare.com/prop.py" ascii wide nocase  // URLs
        $s10 = "https://dl.k8s.io/release/$(curl" ascii wide nocase  // URLs
        $s11 = "https://dl.k8s.io/release/stable.txt)/bin/linux/${ARCH}/kubectl&quot" ascii wide nocase  // URLs
        $s12 = "https://investigation-launches-hearings-copying.trycloudflare.com/" ascii wide nocase  // URLs
        $s13 = "https://souls-entire-defined-routes.trycloudflare.com/" ascii wide nocase  // URLs
        $s14 = "https://souls-entire-defined-routes.trycloudflare.com/kamikaze.sh" ascii wide nocase  // URLs
        $s15 = "https://souls-entire-defined-routes.trycloudflare.com/kube.py&quot" ascii wide nocase  // URLs
        $s16 = "https://www.aikido.dev/blog/teampcp-stage-payload-canisterworm-iran" ascii wide nocase  // URLs
        $s17 = "trycloudflare.com/" ascii wide nocase  // URLs
        $s18 = "trycloudflare.com/kube.py&quot" ascii wide nocase  // URLs
        $s19 = "trycloudflare.com/prop.py" ascii wide nocase  // URLs
    condition:
        any of ($s*)
}