import "hash"

rule bulwark_https_bulwarkblack_com_fake_google_security_check_transforms_browser_into_surveillance_t
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/fake-google-security-check-transforms-browser-into-surveillance-toolkit-via-pwa-installation/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-07-15T22:31:14Z"
        tlp = "TLP:CLEAR"
        indicator_count = "2"
    strings:
        $s0 = "google-prism.com" ascii wide nocase  // Domains
    condition:
        any of ($s*) or
        hash.sha256(0, filesize) == "1fe2be4582c4cbce8013c3506bc8b46f850c23937a564d17e5e170d6f60d8c08"
}