// publicmosaic.yar — generated 2026-10-31 10:37 UTC — 1 rule, 4 hashes — TLP:CLEAR
// source: https://publicmosaic.com — published for defensive use
// scope: configuration endpoint — https://publicmosaic.com/config/endpoint/MTU0Ljg4Ljk4LjQzOjg4ODU
// basis: SHA-256 hash match only; no string or byte patterns.
// Files known only by their Content-Type header are excluded.
import "hash"

rule PublicMosaic_vshell_hashes
{
    meta:
        description = "VShell files observed by Public Mosaic, matched by SHA-256"
        basis = "hash match; no file bytes held"
        provenance = "file analysis, sandbox run"
        reference = "https://publicmosaic.com/config/endpoint/MTU0Ljg4Ljk4LjQzOjg4ODU"
        generated = "2026-10-31 10:37 UTC"
        tlp = "clear"
    condition:
        hash.sha256(0, filesize) == "01768bfe9b54f212fd2b20f729f7c3937d1189a3077ba116a28d26dc139d840f"
        or hash.sha256(0, filesize) == "4b0f9002a5411d168a2bd323681c5716940ba6b744141710cae6a673a92d72a7"
        or hash.sha256(0, filesize) == "f1ad6ab0157884c58b0d48b939dfb948f1a6f4cb6d1ea6d3b914c4801568b276"
        or hash.sha256(0, filesize) == "fdbbe4fe8e87f16d25ddce8ae1f00a3dc1318959022e103721d4d49206ecc859"
}