import "hash"

rule bulwark_https_bulwarkblack_com_ta488_outlook_web_access_owareaper_half_click_exploit
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/ta488-outlook-web-access-owareaper-half-click-exploit/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-07-31T01:06:13Z"
        tlp = "TLP:CLEAR"
        indicator_count = "9"
    strings:
        $s0 = "Weserv.nl" ascii wide nocase  // Domains
        $s1 = "acocdn.com" ascii wide nocase  // Domains
        $s2 = "asecdns.com" ascii wide nocase  // Domains
        $s3 = "dnsrecursive.eu" ascii wide nocase  // Domains
        $s4 = "i3.wp.com" ascii wide nocase  // Domains
        $s5 = "images.weserv.nl" ascii wide nocase  // Domains
        $s6 = "slack-imgs.com" ascii wide nocase  // Domains
        $s7 = "tdndns.com" ascii wide nocase  // Domains
    condition:
        any of ($s*) or
        hash.sha256(0, filesize) == "6897b649f29e54d8910459963bbf94ed5c7a4fe66a56bc5962540b226b8e48c4"
}