rule bulwark_https_bulwarkblack_com_the_promptware_kill_chain_a_new_framework_for_understanding_ai_ma
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/the-promptware-kill-chain-a-new-framework-for-understanding-ai-malware-attacks/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-07-15T22:57:55Z"
        tlp = "TLP:CLEAR"
        indicator_count = "8"
    strings:
        $s0 = "Kore.ai" ascii wide nocase  // Domains
        $s1 = "VerifiedVoting.org" ascii wide nocase  // Domains
        $s2 = "doi.org" ascii wide nocase  // Domains
        $s3 = "go.nature.com" ascii wide nocase  // Domains
        $s4 = "www.schneier.com" ascii wide nocase  // Domains
        $s5 = "https://doi.org/10.48550/arXiv.2509.14233" ascii wide nocase  // URLs
        $s6 = "https://www.schneier.com" ascii wide nocase  // URLs
        $s7 = "schneier@schneier.com" ascii wide nocase  // Email Addresses
    condition:
        any of ($s*)
}