// publicmosaic.yar — generated 2026-10-31 11:37 UTC — 1 rule, 4 hashes — TLP:CLEAR
// source: https://publicmosaic.com — published for defensive use
// scope: configuration endpoint — https://publicmosaic.com/config/endpoint/MTU0LjkxLjYwLjEwNjo4MDk0
// basis: SHA-256 hash match only; no string or byte patterns.
// Files known only by their Content-Type header are excluded.
import "hash"

rule PublicMosaic_vshell_hashes
{
    meta:
        description = "VShell files observed by Public Mosaic, matched by SHA-256"
        basis = "hash match; no file bytes held"
        provenance = "file analysis, sandbox run"
        reference = "https://publicmosaic.com/config/endpoint/MTU0LjkxLjYwLjEwNjo4MDk0"
        generated = "2026-10-31 11:37 UTC"
        tlp = "clear"
    condition:
        hash.sha256(0, filesize) == "1c4144f113996d71916c39d627db83c26e30373b502c2a7200f3eb4ceea80342"
        or hash.sha256(0, filesize) == "b0a440e16f378311e22cd6e526869d8f69e69e662ba78a452d8495ff0fab3189"
        or hash.sha256(0, filesize) == "e2731475546d3ce6f6a1d6fcc1a799da871e1b4ad1406794873dde370cc08b84"
        or hash.sha256(0, filesize) == "e29ed128137fb28c4c6108eeb65109b7cd4192ada4f512d3f6f3a08a69c737a6"
}