// publicmosaic.yar — generated 2026-10-31 09:07 UTC — 1 rule, 4 hashes — TLP:CLEAR
// source: https://publicmosaic.com — published for defensive use
// scope: configuration endpoint — https://publicmosaic.com/config/endpoint/MTU0Ljg4LjEwMi4zNDo4ODg0
// basis: SHA-256 hash match only; no string or byte patterns.
// Files known only by their Content-Type header are excluded.
import "hash"

rule PublicMosaic_vshell_hashes
{
    meta:
        description = "VShell files observed by Public Mosaic, matched by SHA-256"
        basis = "hash match; no file bytes held"
        provenance = "file analysis, sandbox run"
        reference = "https://publicmosaic.com/config/endpoint/MTU0Ljg4LjEwMi4zNDo4ODg0"
        generated = "2026-10-31 09:07 UTC"
        tlp = "clear"
    condition:
        hash.sha256(0, filesize) == "58ed7f89c484b7a7914bfcf007281acef2f1c0c8ebc58ddb33b5787f2ebe4f57"
        or hash.sha256(0, filesize) == "aec664af75d07b72bd163fb0c084f6677a94b8dac7229fd2c36ae58c6f4977a6"
        or hash.sha256(0, filesize) == "d57a2303d6f47af2ce575b3d71d14187b46472c3a51457cce45de66a81eb838d"
        or hash.sha256(0, filesize) == "db8b01738570dc41c656dc32f79adc2c89841750a9c0fea651c6db9c43555eca"
}