import "hash"

rule bulwark_https_bulwarkblack_com_mini_shai_hulud_antv_npm_cicd_secrets_defense
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/mini-shai-hulud-antv-npm-cicd-secrets-defense/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-19T05:28:03Z"
        tlp = "TLP:CLEAR"
        indicator_count = "7"
    strings:
        $s0 = "m-kosche.com" ascii wide nocase  // Domains
        $s1 = "t.m-kosche.com" ascii wide nocase  // Domains
    condition:
        any of ($s*) or
        hash.md5(0, filesize) == "7f44e4ba6f6a71bd0f789e7f83bd3104" or
        hash.sha1(0, filesize) == "7cb42f57561c321ecb09b4552802ae0ac55b3a7a" or
        hash.sha256(0, filesize) == "a68dd1e6a6e35ec3771e1f94fe796f55dfe65a2b94560516ff4ac189390dfa1c" or
        hash.sha256(0, filesize) == "a8269c01069452afb8a54de904e6419578d155fdbdb9e566bab8576a4266b61e" or
        hash.sha256(0, filesize) == "fb5c97557230a27460fdab01fafcfabeaa49590bafd5b6ef30501aa9e0a51142"
}