// publicmosaic.yar — generated 2026-10-30 21:37 UTC — 1 rule, 4 hashes — TLP:CLEAR
// source: https://publicmosaic.com — published for defensive use
// scope: configuration endpoint — https://publicmosaic.com/config/endpoint/MjA2LjE4OC4xOTYuMjIxOjgw
// basis: SHA-256 hash match only; no string or byte patterns.
// Files known only by their Content-Type header are excluded.
import "hash"

rule PublicMosaic_vshell_hashes
{
    meta:
        description = "VShell files observed by Public Mosaic, matched by SHA-256"
        basis = "hash match; no file bytes held"
        provenance = "file analysis, sandbox run"
        reference = "https://publicmosaic.com/config/endpoint/MjA2LjE4OC4xOTYuMjIxOjgw"
        generated = "2026-10-30 21:37 UTC"
        tlp = "clear"
    condition:
        hash.sha256(0, filesize) == "14c908274c0600405170955f8ef89f10f76c4cc4ff2a6d552fd851eeabd043ff"
        or hash.sha256(0, filesize) == "8ef66e6664ee27c65d7ba18ea9821535e0abbe575491d21ee2384cd30ca43f88"
        or hash.sha256(0, filesize) == "92c60be9ac4e2472c5ccde23787ea203ea019dfe59479b61fca310040d34f8d4"
        or hash.sha256(0, filesize) == "df20dccb1c5c73534889ad2e61bdbd1f751341f68074ff343ad6d2bdf14026aa"
}