rule bulwark_https_bulwarkblack_com_nable_ncentral_active_exploitation_msp_control_plane_defense
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/nable-ncentral-active-exploitation-msp-control-plane-defense/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-02T20:08:10Z"
        tlp = "TLP:CLEAR"
        indicator_count = "6"
    strings:
        $s0 = "www.cve.org" ascii wide nocase  // Domains
        $s1 = "https://www.cve.org/CVERecord?id=CVE-2026-18556" ascii wide nocase  // URLs
        $s2 = "173.249.252.200" ascii wide nocase  // IPv4
        $s3 = "37.19.210.32" ascii wide nocase  // IPv4
        $s4 = "68.235.46.214" ascii wide nocase  // IPv4
        $s5 = "87.249.138.34" ascii wide nocase  // IPv4
    condition:
        any of ($s*)
}