// publicmosaic.yar — generated 2026-10-30 21:07 UTC — 1 rule, 3 hashes — TLP:CLEAR
// source: https://publicmosaic.com — published for defensive use
// scope: configuration endpoint — https://publicmosaic.com/config/endpoint/MTU0LjkxLjYxLjEyMTo4MDc0
// basis: SHA-256 hash match only; no string or byte patterns.
// Files known only by their Content-Type header are excluded.
import "hash"

rule PublicMosaic_vshell_hashes
{
    meta:
        description = "VShell files observed by Public Mosaic, matched by SHA-256"
        basis = "hash match; no file bytes held"
        provenance = "file analysis"
        reference = "https://publicmosaic.com/config/endpoint/MTU0LjkxLjYxLjEyMTo4MDc0"
        generated = "2026-10-30 21:07 UTC"
        tlp = "clear"
    condition:
        hash.sha256(0, filesize) == "52c08c53de4396ef4ddd54e5b0b1b9b5aa2feacb3d14c53b393c21fdad1fb500"
        or hash.sha256(0, filesize) == "87433de788e44e0975209ae43ba4a99d806f4ea052b1e6eb62d5a01e53b2be20"
        or hash.sha256(0, filesize) == "b21403fd492bd7a9e1de6f00c2dd914164c3e0f947c73bec7fdd42828672fa0f"
}