// publicmosaic.yar — generated 2026-10-31 05:07 UTC — 1 rule, 4 hashes — TLP:CLEAR
// source: https://publicmosaic.com — published for defensive use
// scope: configuration endpoint — https://publicmosaic.com/config/endpoint/MTU0Ljg4LjEwMS41Mjo4ODg1
// basis: SHA-256 hash match only; no string or byte patterns.
// Files known only by their Content-Type header are excluded.
import "hash"

rule PublicMosaic_vshell_hashes
{
    meta:
        description = "VShell files observed by Public Mosaic, matched by SHA-256"
        basis = "hash match; no file bytes held"
        provenance = "file analysis, sandbox run"
        reference = "https://publicmosaic.com/config/endpoint/MTU0Ljg4LjEwMS41Mjo4ODg1"
        generated = "2026-10-31 05:07 UTC"
        tlp = "clear"
    condition:
        hash.sha256(0, filesize) == "3681e20c311197ab2be3bcc5aa12c81da7bac4ae43ace5a977cade6739ce4cd9"
        or hash.sha256(0, filesize) == "884f6389de8af100e2ba524d5102f5779a5628f1194962468a00337e9379b463"
        or hash.sha256(0, filesize) == "c514d0e23ba0a2eb75e362c8ac32a1a7b7ebea2e506ea4aab908209cf31a9b45"
        or hash.sha256(0, filesize) == "d6e2670131bcdf5e5ee6ebc357f97df26c0e6f68e7f71cc75f6b3d0cb9b6e8a2"
}