// publicmosaic.yar — generated 2026-10-30 22:07 UTC — 1 rule, 4 hashes — TLP:CLEAR
// source: https://publicmosaic.com — published for defensive use
// scope: configuration endpoint — https://publicmosaic.com/config/endpoint/MTM0LjEyMi4xNTQuOTI6MjA4Ng
// basis: SHA-256 hash match only; no string or byte patterns.
// Files known only by their Content-Type header are excluded.
import "hash"

rule PublicMosaic_vshell_hashes
{
    meta:
        description = "VShell files observed by Public Mosaic, matched by SHA-256"
        basis = "hash match; no file bytes held"
        provenance = "file analysis, sandbox run"
        reference = "https://publicmosaic.com/config/endpoint/MTM0LjEyMi4xNTQuOTI6MjA4Ng"
        generated = "2026-10-30 22:07 UTC"
        tlp = "clear"
    condition:
        hash.sha256(0, filesize) == "0e991cdf15870c390f78f76d294add7598934eedc5f065f5a334fa45e0cbe793"
        or hash.sha256(0, filesize) == "9c353b8ede5b95f23bc4cd9b10dee26ad9839acc59bdfd590dc1d35e00d38789"
        or hash.sha256(0, filesize) == "adf90b483c614aec1ccf059339ec96ed3a0afe961993935eef24a8a418c36e9f"
        or hash.sha256(0, filesize) == "dc4d1a75c2c44d66e201c81c2541be2cc063a3537c8b9004fbbb43ed9f35b5ab"
}