trunk/f3c42a6434f6b500d1b99a35a792a319c0e489e3: Use std::to_array/std::initializer_list (#185607)

rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-25"
        description = "YARA Signature for "
    strings:
        $str = "trunk/f3c42a6434f6b500d1b99a35" ascii wide
    condition:
        any of them
}

index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("trunkf3c42a6434f6b500d1b99a35a792a319c0e")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count

message: "*trunkf3c42a6434f6b500d1b99a35a792a319c0e*"

CommonSecurityLog
| where Message has "trunkf3c42a6434f6b500d1b99a35a792a319c0e"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc