// publicmosaic.yar — generated 2026-10-31 05:37 UTC — 1 rule, 4 hashes — TLP:CLEAR
// source: https://publicmosaic.com — published for defensive use
// scope: configuration endpoint — https://publicmosaic.com/config/endpoint/MTU0Ljg4LjEwMy40Mjo4ODg1
// basis: SHA-256 hash match only; no string or byte patterns.
// Files known only by their Content-Type header are excluded.
import "hash"

rule PublicMosaic_vshell_hashes
{
    meta:
        description = "VShell files observed by Public Mosaic, matched by SHA-256"
        basis = "hash match; no file bytes held"
        provenance = "file analysis, sandbox run"
        reference = "https://publicmosaic.com/config/endpoint/MTU0Ljg4LjEwMy40Mjo4ODg1"
        generated = "2026-10-31 05:37 UTC"
        tlp = "clear"
    condition:
        hash.sha256(0, filesize) == "3393ce388d843231e308f8863ddec50a6f81f2be48bdbb07ba4d00dfafd55126"
        or hash.sha256(0, filesize) == "52d225d86a2e2422da98e73cc982ba72c6c04f11306a7a4e9cf4927f997fe082"
        or hash.sha256(0, filesize) == "d9707601726a40d8468eef54bb878e26e00b1bae6ec20508a51f00bc7c41bf07"
        or hash.sha256(0, filesize) == "de8e50d7d055782b16d6aba8250d931de4233034cd691945745c04e7f4c637ee"
}