// publicmosaic.yar — generated 2026-10-31 04:07 UTC — 1 rule, 4 hashes — TLP:CLEAR
// source: https://publicmosaic.com — published for defensive use
// scope: configuration endpoint — https://publicmosaic.com/config/endpoint/MTkyLjI0My4xMjAuMjM5OjgwODk
// basis: SHA-256 hash match only; no string or byte patterns.
// Files known only by their Content-Type header are excluded.
import "hash"

rule PublicMosaic_vshell_hashes
{
    meta:
        description = "VShell files observed by Public Mosaic, matched by SHA-256"
        basis = "hash match; no file bytes held"
        provenance = "file analysis, sandbox run"
        reference = "https://publicmosaic.com/config/endpoint/MTkyLjI0My4xMjAuMjM5OjgwODk"
        generated = "2026-10-31 04:07 UTC"
        tlp = "clear"
    condition:
        hash.sha256(0, filesize) == "259c84dab39c8b2fc2b681114a056c0d3a7080a9726f1069101f4a8dfb2b8d2c"
        or hash.sha256(0, filesize) == "8b13011e3740cb88d81933b7f6f9762358f6f5da59e4d2be9470e0525e90f12a"
        or hash.sha256(0, filesize) == "ae7edd218685063483651300b54e27a04946531234bde116e19526c8e86810d3"
        or hash.sha256(0, filesize) == "cb1eeb8378378edfa09b8b495a6808483a4aacaa46279918c3b4b6c857b3825a"
}