// publicmosaic.yar — generated 2026-10-31 03:37 UTC — 1 rule, 4 hashes — TLP:CLEAR
// source: https://publicmosaic.com — published for defensive use
// scope: configuration endpoint — https://publicmosaic.com/config/endpoint/MTU2LjIzOC4xMjAuMTM6MTgwODQ
// basis: SHA-256 hash match only; no string or byte patterns.
// Files known only by their Content-Type header are excluded.
import "hash"

rule PublicMosaic_vshell_hashes
{
    meta:
        description = "VShell files observed by Public Mosaic, matched by SHA-256"
        basis = "hash match; no file bytes held"
        provenance = "file analysis, sandbox run"
        reference = "https://publicmosaic.com/config/endpoint/MTU2LjIzOC4xMjAuMTM6MTgwODQ"
        generated = "2026-10-31 03:37 UTC"
        tlp = "clear"
    condition:
        hash.sha256(0, filesize) == "0032cb5f7bde0a1bdb4426264dcfc1d9fe8a33436520a1abbbfee4053e9ce772"
        or hash.sha256(0, filesize) == "9db369e903f5eaec5d918efbca934eb026dbe7e18de99cb08752186e0c4d1370"
        or hash.sha256(0, filesize) == "cd1d45bf36b3a5178a7c482b759d043b362ab767882f1080e1c3c19f7e30aed6"
        or hash.sha256(0, filesize) == "fbea2bc3a336a2f118d1af39abc3187cb7f8c816f3ccb2e24bdc946b28226eaa"
}