import "hash"

rule bulwark_https_bulwarkblack_com_pawn_storm_deploys_prismex_malware_suite_against_ukrainian_defens
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/pawn-storm-deploys-prismex-malware-suite-against-ukrainian-defense-supply-chain-and-nato-allies/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-07-15T22:56:40Z"
        tlp = "TLP:CLEAR"
        indicator_count = "11"
    strings:
        $s0 = "Filen.io" ascii wide nocase  // Domains
        $s1 = "claude.ai" ascii wide nocase  // Domains
        $s2 = "dropbox.com" ascii wide nocase  // Domains
        $s3 = "egest.filen.io" ascii wide nocase  // Domains
        $s4 = "gateway.filen-1.net" ascii wide nocase  // Domains
        $s5 = "gateway.filen-6.net" ascii wide nocase  // Domains
        $s6 = "gateway.filen.io" ascii wide nocase  // Domains
        $s7 = "gateway.filen.net" ascii wide nocase  // Domains
        $s8 = "ingest.filen.io" ascii wide nocase  // Domains
        $s9 = "wellnesscaremed.com" ascii wide nocase  // Domains
    condition:
        any of ($s*) or
        hash.sha256(0, filesize) == "aefd15e3c395edd16ede7685c6e97ca0350a702ee7c8585274b457166e86b1fa"
}