import "hash"

rule bulwark_https_bulwarkblack_com_encase_forensic_driver_weaponized_byovd_attack_targets_59_edr_too
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/encase-forensic-driver-weaponized-byovd-attack-targets-59-edr-tools-through-sonicwall-vpn-breach/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-07-15T22:31:05Z"
        tlp = "TLP:CLEAR"
        indicator_count = "5"
    strings:
        $s0 = "OemHwUpd.sy" ascii wide nocase  // Domains
        $s1 = "193.160.216.221" ascii wide nocase  // IPv4
        $s2 = "69.10.60.250" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.sha256(0, filesize) == "3111f4d7d4fac55103453c4c8adb742def007b96b7c8ed265347df97137fbee0" or
        hash.sha256(0, filesize) == "6a6aaeed4a6bbe82a08d197f5d40c2592a461175f181e0440e0ff45d5fb60939"
}