rule bulwark_https_bulwarkblack_com_macsync_stealer_behavioral_pivots_macos_defense
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/macsync-stealer-behavioral-pivots-macos-defense/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-19T04:55:27Z"
        tlp = "TLP:CLEAR"
        indicator_count = "31"
    strings:
        $s0 = "aihealthring.com" ascii wide nocase  // Domains
        $s1 = "cabinrentalsnc.com" ascii wide nocase  // Domains
        $s2 = "chatbasedos.com" ascii wide nocase  // Domains
        $s3 = "commercialroofingsd.com" ascii wide nocase  // Domains
        $s4 = "dogtrainersgeorgia.com" ascii wide nocase  // Domains
        $s5 = "fintelliganceai.com" ascii wide nocase  // Domains
        $s6 = "homeinspectionsdelaware.com" ascii wide nocase  // Domains
        $s7 = "intopython.com" ascii wide nocase  // Domains
        $s8 = "lalandscapelighting.com" ascii wide nocase  // Domains
        $s9 = "lumenagnet.com" ascii wide nocase  // Domains
        $s10 = "marbellaresales.com" ascii wide nocase  // Domains
        $s11 = "miamipcsupport.com" ascii wide nocase  // Domains
        $s12 = "moldinspectiondayton.com" ascii wide nocase  // Domains
        $s13 = "nailscanai.com" ascii wide nocase  // Domains
        $s14 = "newjerseypetsitter.com" ascii wide nocase  // Domains
        $s15 = "numericagent.com" ascii wide nocase  // Domains
        $s16 = "oaklandwaterdamage.com" ascii wide nocase  // Domains
        $s17 = "oklahomawarehousing.com" ascii wide nocase  // Domains
        $s18 = "olympiapetemergency.com" ascii wide nocase  // Domains
        $s19 = "peaecagent.com" ascii wide nocase  // Domains
        $s20 = "plasmaticsystems.com" ascii wide nocase  // Domains
        $s21 = "plethorawallet.com" ascii wide nocase  // Domains
        $s22 = "premierrentalpurchase.com" ascii wide nocase  // Domains
        $s23 = "ricewaterbeauty.com" ascii wide nocase  // Domains
        $s24 = "rvieragent.com" ascii wide nocase  // Domains
        $s25 = "sandiegotkd.com" ascii wide nocase  // Domains
        $s26 = "secueragent.com" ascii wide nocase  // Domains
        $s27 = "shiledagent.com" ascii wide nocase  // Domains
        $s28 = "syracusefertilitycenter.com" ascii wide nocase  // Domains
        $s29 = "vastbets.com" ascii wide nocase  // Domains
        $s30 = "wvaeagent.com" ascii wide nocase  // Domains
    condition:
        any of ($s*)
}