// publicmosaic.yar — generated 2026-10-30 20:07 UTC — 1 rule, 3 hashes — TLP:CLEAR
// source: https://publicmosaic.com — published for defensive use
// scope: configuration endpoint — https://publicmosaic.com/config/endpoint/MTU0LjkxLjYwLjExNjo4MDc0
// basis: SHA-256 hash match only; no string or byte patterns.
// Files known only by their Content-Type header are excluded.
import "hash"

rule PublicMosaic_vshell_hashes
{
    meta:
        description = "VShell files observed by Public Mosaic, matched by SHA-256"
        basis = "hash match; no file bytes held"
        provenance = "file analysis"
        reference = "https://publicmosaic.com/config/endpoint/MTU0LjkxLjYwLjExNjo4MDc0"
        generated = "2026-10-30 20:07 UTC"
        tlp = "clear"
    condition:
        hash.sha256(0, filesize) == "295b237c1453716a1d9687c08f6843334d2f328d4d2fa31c00e3f6afe16e201a"
        or hash.sha256(0, filesize) == "4c4e5626476ee7a95fa7528dbfe3d028b5ae1231248b237f619f319d99778afa"
        or hash.sha256(0, filesize) == "a2633c9b91af63eecd38ba1664f2e846946ae4e6ad4dfba4f4f34d9ec91ad638"
}