// publicmosaic.yar — generated 2026-10-31 05:37 UTC — 1 rule, 4 hashes — TLP:CLEAR
// source: https://publicmosaic.com — published for defensive use
// scope: configuration endpoint — https://publicmosaic.com/config/endpoint/MTU0Ljg4LjEwMS4zNTo4ODg0
// basis: SHA-256 hash match only; no string or byte patterns.
// Files known only by their Content-Type header are excluded.
import "hash"

rule PublicMosaic_vshell_hashes
{
    meta:
        description = "VShell files observed by Public Mosaic, matched by SHA-256"
        basis = "hash match; no file bytes held"
        provenance = "file analysis, sandbox run"
        reference = "https://publicmosaic.com/config/endpoint/MTU0Ljg4LjEwMS4zNTo4ODg0"
        generated = "2026-10-31 05:37 UTC"
        tlp = "clear"
    condition:
        hash.sha256(0, filesize) == "490693f5ae381a20ed63e9033d79260659242a63ca958c213db4a3f45ed82329"
        or hash.sha256(0, filesize) == "aba02ed95d40948fc02c40c55f25966b85c38c034a933459bb71447ca29fba5f"
        or hash.sha256(0, filesize) == "b77fc11badeac6cd19baba39af912e01eda6d409e151eca3b77fafb3135bc0fc"
        or hash.sha256(0, filesize) == "bfa14254d537cd0d4424ee9bab8ac0f9c8c80a5dabff569753eacd6e9b1c6450"
}