/*
  Candidate rules v1.0 — 2026-09-06.
  Text matching only; never a standalone infection verdict.
  This file is detection logic, not a malware sample.
*/
rule Campaign_Candidate_Automatic_Node_Font {
  meta:
    description = "Automatic editor task referencing Node execution of a font-named file"
    confidence = "candidate"
    version = "1.0"
  strings:
    $open = "\"folderOpen\""
    $node = /node[ \t]+[^"\r\n]{0,220}\.woff2?/
  condition:
    filesize < 200KB and $open and $node
}
rule Campaign_Candidate_NullReceiver_Literals {
  meta:
    description = "Known sender wallet co-occurs with Ethereum resolver and stage transport strings"
    confidence = "candidate; research references may match"
    version = "1.0"
  strings:
    $wallet = "0xa322e5f3d311d3080e6f0121063e9adc2490ef1a" nocase
    $resolver1 = "eth_getBlockByNumber"
    $resolver2 = "eth_getTransactionCount"
    $stage1 = "X-Payload-B64"
    $stage2 = "/0x/ls"
  condition:
    filesize < 200KB and $wallet and 1 of ($resolver*) and 1 of ($stage*)
}
rule Campaign_Candidate_Shared_Ignore_Entries {
  meta:
    description = "Supporting co-change template; also occurs in research archives"
    confidence = "low"
    version = "1.0"
  strings:
    $a = "branch_structure.json"
    $b = "temp_auto_push.bat"
    $c = "temp_interactive_push.bat"
  condition:
    filesize < 20KB and all of them
}