// publicmosaic.yar — generated 2026-10-30 21:07 UTC — 1 rule, 4 hashes — TLP:CLEAR
// source: https://publicmosaic.com — published for defensive use
// scope: configuration endpoint — https://publicmosaic.com/config/endpoint/MTU2LjIzOC4xMjEuMTgwOjgwODY
// basis: SHA-256 hash match only; no string or byte patterns.
// Files known only by their Content-Type header are excluded.
import "hash"

rule PublicMosaic_vshell_hashes
{
    meta:
        description = "VShell files observed by Public Mosaic, matched by SHA-256"
        basis = "hash match; no file bytes held"
        provenance = "file analysis, sandbox run"
        reference = "https://publicmosaic.com/config/endpoint/MTU2LjIzOC4xMjEuMTgwOjgwODY"
        generated = "2026-10-30 21:07 UTC"
        tlp = "clear"
    condition:
        hash.sha256(0, filesize) == "33ad652c54591eec8349760b4d50eb77b7180d941573a98a134d01706688fe0d"
        or hash.sha256(0, filesize) == "33ffd27ec2004a8fbe82d2a51c023c9ce31e4c43e62df614ce0d2a69ed81af10"
        or hash.sha256(0, filesize) == "a3f83c5fb1730ea4f1aee8cc7ef28a6f3c6446ba409359e41a6c6b04cb322a14"
        or hash.sha256(0, filesize) == "c2ed384e44a51d0e787ba378cbfcfabf7301a99381ec730b00f8610ab52c978b"
}