import "hash"

rule bulwark_https_bulwarkblack_com_russian_auth_flow_phishing_mfa_defense
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/russian-auth-flow-phishing-mfa-defense/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-22T20:09:16Z"
        tlp = "TLP:CLEAR"
        indicator_count = "47"
    strings:
        $s0 = "chamber-ua.org" ascii wide nocase  // Domains
        $s1 = "dosportal.app" ascii wide nocase  // Domains
        $s2 = "drive.google.verify-drive.com" ascii wide nocase  // Domains
        $s3 = "fewfwfwfwfwf.info" ascii wide nocase  // Domains
        $s4 = "finishoperations.com" ascii wide nocase  // Domains
        $s5 = "finishoperations.org" ascii wide nocase  // Domains
        $s6 = "foc-share.com" ascii wide nocase  // Domains
        $s7 = "foc-share.org" ascii wide nocase  // Domains
        $s8 = "foreignrelations.us" ascii wide nocase  // Domains
        $s9 = "globsec.net" ascii wide nocase  // Domains
        $s10 = "internal-share.com" ascii wide nocase  // Domains
        $s11 = "m365-owa.com" ascii wide nocase  // Domains
        $s12 = "mail.kiis.co.uk" ascii wide nocase  // Domains
        $s13 = "mioisiskwowiwjowuwjwolab.club" ascii wide nocase  // Domains
        $s14 = "miov2iaiaoubqosiqoiajwowiwjso.online" ascii wide nocase  // Domains
        $s15 = "ms365-device.com" ascii wide nocase  // Domains
        $s16 = "ms365-live.com" ascii wide nocase  // Domains
        $s17 = "my-invite.org" ascii wide nocase  // Domains
        $s18 = "owa-ms365.com" ascii wide nocase  // Domains
        $s19 = "share-foc.com" ascii wide nocase  // Domains
        $s20 = "shopinvite.org" ascii wide nocase  // Domains
        $s21 = "statistic-ms.live" ascii wide nocase  // Domains
        $s22 = "verify-drive.com" ascii wide nocase  // Domains
        $s23 = "wa-connect.eu" ascii wide nocase  // Domains
        $s24 = "wa-connect.net" ascii wide nocase  // Domains
        $s25 = "wa-device.com" ascii wide nocase  // Domains
        $s26 = "wa-invite.com" ascii wide nocase  // Domains
        $s27 = "wa-meeting.com" ascii wide nocase  // Domains
        $s28 = "104.194.159.150" ascii wide nocase  // IPv4
        $s29 = "107.189.18.7" ascii wide nocase  // IPv4
        $s30 = "196.251.107.171" ascii wide nocase  // IPv4
        $s31 = "31.57.243.154" ascii wide nocase  // IPv4
        $s32 = "38.146.28.75" ascii wide nocase  // IPv4
        $s33 = "bounce@chamber-ua.org" ascii wide nocase  // Email Addresses
    condition:
        any of ($s*) or
        hash.sha256(0, filesize) == "125752ad7c20d715920a3b2fb0fdde660f07b3f2b053665cf38c2d6d9de86e1e" or
        hash.sha256(0, filesize) == "1d9299799a7b8da67c44ebec064d64542c27645f8e84de4a22ca3f6cbc843e3c" or
        hash.sha256(0, filesize) == "1e3ee845fde739fcd3ca9ce62c7f142a7c501d11db4c4fb294d4939f12d0f916" or
        hash.sha256(0, filesize) == "20e20b074967ed6f6e04d609ccec5ff7492665ef25f894c90c2ddc92fa47ac38" or
        hash.sha256(0, filesize) == "28f622028e690c943f7fa9aca426c07cab52b5aaba757ef8a3328609c0b3bec3" or
        hash.sha256(0, filesize) == "2c7f4165967d6f7737b3fef87959846920b57a5368b531ad1427c7214d4c41a2" or
        hash.sha256(0, filesize) == "403b624e35777cbc07dbe66398b21bba70396a20b859c880732338ce1dd1f41f" or
        hash.sha256(0, filesize) == "5b8d50c2e8cc3038b7c6e6dbf1219f6e814930a1e3c0053143a1191ae67f8ffc" or
        hash.sha256(0, filesize) == "6f7090895c1c3dee30de6b3f098ca3a788dc198646e5293a8b1210430b0add97" or
        hash.sha256(0, filesize) == "a06a8fd1b6fa1924199a4540cf16d089217ce8f78c617739946f145fd1fc88c1" or
        hash.sha256(0, filesize) == "be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c" or
        hash.sha256(0, filesize) == "c5826032207d623a7f6caec8465af7364eccc355f9a48897da2a54f3e4420265" or
        hash.sha256(0, filesize) == "ca3be5885afb3eb3bb19341e2653212200c568f3f900e0b2f04de9ba209aed25"
}