rule bulwark_https_bulwarkblack_com_smartapesg_okendo_widget_supply_chain_risk
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/smartapesg-okendo-widget-supply-chain-risk/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-07-15T22:57:19Z"
        tlp = "TLP:CLEAR"
        indicator_count = "12"
    strings:
        $s0 = "api.wigetticks.com" ascii wide nocase  // Domains
        $s1 = "api.wizzleticks.com" ascii wide nocase  // Domains
        $s2 = "cdn-static.okendo.io" ascii wide nocase  // Domains
        $s3 = "okendo.io" ascii wide nocase  // Domains
        $s4 = "wigetticks.com" ascii wide nocase  // Domains
        $s5 = "wizzleticks.com" ascii wide nocase  // Domains
        $s6 = "api.wigetticks.com/logout/private-response[" ascii wide nocase  // URLs
        $s7 = "api.wizzleticks.com/claims/scope-schema[" ascii wide nocase  // URLs
        $s8 = "cdn-static.okendo.io/reviews-widget-plus/js/okendo-reviews[" ascii wide nocase  // URLs
        $s9 = "http://cdn-static.okendo.io/reviews-widget-plus/js/okendo-reviews.js" ascii wide nocase  // URLs
        $s10 = "https://api.wigetticks.com/logout/private-response.php?8D1V4th3" ascii wide nocase  // URLs
        $s11 = "https://api.wizzleticks.com/claims/scope-schema.php?4ManBBdA" ascii wide nocase  // URLs
    condition:
        any of ($s*)
}