rule bulwark_https_bulwarkblack_com_velocloud_orchestrator_rce_sdwan_incident_response
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/velocloud-orchestrator-rce-sdwan-incident-response/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-10T01:04:40Z"
        tlp = "TLP:CLEAR"
        indicator_count = "8"
    strings:
        $s0 = "206.72.242.124" ascii wide nocase  // IPv4
        $s1 = "206.72.242.162" ascii wide nocase  // IPv4
        $s2 = "5.2.3.14" ascii wide nocase  // IPv4
        $s3 = "6.1.3.4" ascii wide nocase  // IPv4
        $s4 = "6.4.2.4" ascii wide nocase  // IPv4
        $s5 = "7.0.0.1" ascii wide nocase  // IPv4
        $s6 = "8.19.75.217" ascii wide nocase  // IPv4
        $s7 = "contact@resecurity.com" ascii wide nocase  // Email Addresses
    condition:
        any of ($s*)
}