rule bulwark_https_bulwarkblack_com_device_code_phishing_oauth_token_theft_defense
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/device-code-phishing-oauth-token-theft-defense/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-07-15T22:30:59Z"
        tlp = "TLP:CLEAR"
        indicator_count = "46"
    strings:
        $s0 = "019d442a-endpoint.com" ascii wide nocase  // Domains
        $s1 = "019d442e-endpoint.com" ascii wide nocase  // Domains
        $s2 = "019d6860-endpoint.com" ascii wide nocase  // Domains
        $s3 = "0fdba029e6a5-endpoint.com" ascii wide nocase  // Domains
        $s4 = "2dc62559e005-endpoint.com" ascii wide nocase  // Domains
        $s5 = "4daa2aea93db-endpoint.com" ascii wide nocase  // Domains
        $s6 = "6dd5fd945b34-endpoint.com" ascii wide nocase  // Domains
        $s7 = "7740f766-8d1d-46ad-a6bc-onedrive.p-9jluifuu.workers.dev" ascii wide nocase  // Domains
        $s8 = "7806d4cf9366-endpoint.com" ascii wide nocase  // Domains
        $s9 = "audit-report-9767d3.fullerjp09.workers.dev" ascii wide nocase  // Domains
        $s10 = "consistentdigital.de" ascii wide nocase  // Domains
        $s11 = "crediblebizextension.de" ascii wide nocase  // Domains
        $s12 = "digitalcontinuity.de" ascii wide nocase  // Domains
        $s13 = "digitalreliability.de" ascii wide nocase  // Domains
        $s14 = "ed5ce47d835f-endpoint.com" ascii wide nocase  // Domains
        $s15 = "ee10bbf6c689-endpoint.com" ascii wide nocase  // Domains
        $s16 = "euromarketsignal.de" ascii wide nocase  // Domains
        $s17 = "europesignaltrust.de" ascii wide nocase  // Domains
        $s18 = "europetrustwave.de" ascii wide nocase  // Domains
        $s19 = "extendyourcredibility.de" ascii wide nocase  // Domains
        $s20 = "f36c2774f013-endpoint.com" ascii wide nocase  // Domains
        $s21 = "f8uh-dwam-j4l5.pvasquez-princetonpartners-com-s-account.workers.dev" ascii wide nocase  // Domains
        $s22 = "heilbronner-fruehlingssymposium.de" ascii wide nocase  // Domains
        $s23 = "hewktree.net" ascii wide nocase  // Domains
        $s24 = "hs-sites-na2.com" ascii wide nocase  // Domains
        $s25 = "hti-245401512.hs-sites-na2.com" ascii wide nocase  // Domains
        $s26 = "jo2c9ada427c6-endpoint.com" ascii wide nocase  // Domains
        $s27 = "kohlhoff-edelstahlverarbeitung.de" ascii wide nocase  // Domains
        $s28 = "marketcredibilitysignals.de" ascii wide nocase  // Domains
        $s29 = "marktkarree-langenfeld.de" ascii wide nocase  // Domains
        $s30 = "methodicalness.de" ascii wide nocase  // Domains
        $s31 = "onedrive-7tu.techroboticslabmade-techie-com-s-account.workers.dev" ascii wide nocase  // Domains
        $s32 = "panel.hewktree.net" ascii wide nocase  // Domains
        $s33 = "reliableinteractions.de" ascii wide nocase  // Domains
        $s34 = "reliablesupport.de" ascii wide nocase  // Domains
        $s35 = "servicewithoutinterruption.de" ascii wide nocase  // Domains
        $s36 = "stablewebsystems.de" ascii wide nocase  // Domains
        $s37 = "trustedengagement.de" ascii wide nocase  // Domains
        $s38 = "uninterruptedperformance.de" ascii wide nocase  // Domains
        $s39 = "voicemail-59f.admin-treyripple-com-s-account.workers.dev" ascii wide nocase  // Domains
        $s40 = "voicemail-lyr.nbuckley-cambek-com-s-account.workers.dev" ascii wide nocase  // Domains
        $s41 = "voicemail-wx7.mark-squires-expressrancnes-com-s-account.workers.dev" ascii wide nocase  // Domains
        $s42 = "workers.dev" ascii wide nocase  // Domains
        $s43 = "yaga9b286ae2c101-endpoint.com" ascii wide nocase  // Domains
        $s44 = "ytgw-9n30-xlwd.pvasquez-princetonpartners-com-s-account.workers.dev" ascii wide nocase  // Domains
        $s45 = "z6e43e5886fe-endpoint.com" ascii wide nocase  // Domains
    condition:
        any of ($s*)
}