// publicmosaic.yar — generated 2026-10-31 10:07 UTC — 1 rule, 4 hashes — TLP:CLEAR
// source: https://publicmosaic.com — published for defensive use
// scope: configuration endpoint — https://publicmosaic.com/config/endpoint/MTU0Ljg4LjEwMC4zNzo4ODg0
// basis: SHA-256 hash match only; no string or byte patterns.
// Files known only by their Content-Type header are excluded.
import "hash"

rule PublicMosaic_vshell_hashes
{
    meta:
        description = "VShell files observed by Public Mosaic, matched by SHA-256"
        basis = "hash match; no file bytes held"
        provenance = "file analysis, sandbox run"
        reference = "https://publicmosaic.com/config/endpoint/MTU0Ljg4LjEwMC4zNzo4ODg0"
        generated = "2026-10-31 10:07 UTC"
        tlp = "clear"
    condition:
        hash.sha256(0, filesize) == "00cfb0e33226f90d4c18f2dd0fb18485e790f8a4188e31d2e6bed572e0aa1c38"
        or hash.sha256(0, filesize) == "386cc3082f7a54e190aa7481a019e5eeadc28088674be3239b827d3e34d99d11"
        or hash.sha256(0, filesize) == "3b6e43943886bce783daadc3f47c18d918e72e45adb9462d36af44271af8961a"
        or hash.sha256(0, filesize) == "ce6a0ecf627e310511df59405298d8457e8cb6e82c9182e07e44d2694a26caa5"
}