import "hash"

rule bulwark_https_bulwarkblack_com_project_cav3rn_outlook_calendar_dns_c2_defense
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/project-cav3rn-outlook-calendar-dns-c2-defense/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-07-21T20:05:20Z"
        tlp = "TLP:CLEAR"
        indicator_count = "20"
    strings:
        $s0 = "accesslinkssl.com" ascii wide nocase  // Domains
        $s1 = "ayalon-print.co" ascii wide nocase  // Domains
        $s2 = "clipeditskill.com" ascii wide nocase  // Domains
        $s3 = "cloudlanecdn.com" ascii wide nocase  // Domains
        $s4 = "d.53466D4C67515A.0.p.cloudlanecdn.com" ascii wide nocase  // Domains
        $s5 = "dns1.registrar-servers.com" ascii wide nocase  // Domains
        $s6 = "dns2.registrar-servers.com" ascii wide nocase  // Domains
        $s7 = "google.com.ayalon-print.co.il" ascii wide nocase  // Domains
        $s8 = "login.microsoftonline.com" ascii wide nocase  // Domains
        $s9 = "ns1.cloudlanecdn.com" ascii wide nocase  // Domains
        $s10 = "ns2.cloudlanecdn.com" ascii wide nocase  // Domains
        $s11 = "ns3.cloudlanecdn.com" ascii wide nocase  // Domains
        $s12 = "ns4.cloudlanecdn.com" ascii wide nocase  // Domains
        $s13 = "co.il" ascii wide nocase  // URLs
        $s14 = "https://login.microsoftonline.com/<TenantId>/oauth2/v2.0/token" ascii wide nocase  // URLs
        $s15 = "144.172.108.205" ascii wide nocase  // IPv4
        $s16 = "216.126.237.197" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.md5(0, filesize) == "29b2b8c5d99f05bfcdd0d8d976eb5678" or
        hash.md5(0, filesize) == "c092b02fbc0fdf7ee9608dd016673806" or
        hash.md5(0, filesize) == "caf021dda726b8ba049c2aa395e505a1"
}