import "hash"

rule bulwark_https_bulwarkblack_com_mirage_kitten_websocket_tunnels_egress_defense
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/mirage-kitten-websocket-tunnels-egress-defense/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-07-28T15:05:15Z"
        tlp = "TLP:CLEAR"
        indicator_count = "32"
    strings:
        $s0 = "Business-deegital.com" ascii wide nocase  // Domains
        $s1 = "aecert.org" ascii wide nocase  // Domains
        $s2 = "azurewebsites.net" ascii wide nocase  // Domains
        $s3 = "buisness-centeral-transportation.com" ascii wide nocase  // Domains
        $s4 = "business-deegital.azurewebsites.net" ascii wide nocase  // Domains
        $s5 = "business-startup.azurewebsites.net" ascii wide nocase  // Domains
        $s6 = "businessdeegital.azurewebsites.net" ascii wide nocase  // Domains
        $s7 = "businessmixture.com" ascii wide nocase  // Domains
        $s8 = "businessstartup.azurewebsites.net" ascii wide nocase  // Domains
        $s9 = "global-reds.com" ascii wide nocase  // Domains
        $s10 = "healthcarezoom-centeral.azurewebsites.net" ascii wide nocase  // Domains
        $s11 = "healthcarezoomcenteral.azurewebsites.net" ascii wide nocase  // Domains
        $s12 = "healthcarezoomcenteral.org" ascii wide nocase  // Domains
        $s13 = "maadinglobal.com" ascii wide nocase  // Domains
        $s14 = "neexportfolio.azurewebsites.net" ascii wide nocase  // Domains
        $s15 = "neexportfolio.com" ascii wide nocase  // Domains
        $s16 = "realhealthshop.com" ascii wide nocase  // Domains
        $s17 = "smartconnect.azurewebsites.net" ascii wide nocase  // Domains
        $s18 = "thehealth-life.com" ascii wide nocase  // Domains
        $s19 = "tjconsultingservices.com" ascii wide nocase  // Domains
        $s20 = "toadreport.azurewebsites.net" ascii wide nocase  // Domains
        $s21 = "172.86.98.113" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.md5(0, filesize) == "42f847597109da2a220391bb09d00676" or
        hash.md5(0, filesize) == "5fa15ef96808ea82f0a6176f0bb4b386" or
        hash.md5(0, filesize) == "6038d42af0affd1fb263f470c0956f6b" or
        hash.md5(0, filesize) == "a239e655709a2518dd0b7bdbed163679" or
        hash.md5(0, filesize) == "ae628efa305387b633dce82f9364875b" or
        hash.md5(0, filesize) == "afb1c1583606599c7272cfb33cc6f498" or
        hash.md5(0, filesize) == "c832ecd135781b11f59e3fffb3d2b6ac" or
        hash.md5(0, filesize) == "c90f0efadbf322e5eb1c4103a38c30e6" or
        hash.md5(0, filesize) == "d09b14a2fe01c7363ecc56f5d046162c" or
        hash.md5(0, filesize) == "f7d36cc5904a53252d2bb3d21615134f"
}