// publicmosaic.yar — generated 2026-10-31 07:07 UTC — 1 rule, 4 hashes — TLP:CLEAR
// source: https://publicmosaic.com — published for defensive use
// scope: configuration endpoint — https://publicmosaic.com/config/endpoint/MjA3LjkwLjIzOC43Nzo4MA
// basis: SHA-256 hash match only; no string or byte patterns.
// Files known only by their Content-Type header are excluded.
import "hash"

rule PublicMosaic_vshell_hashes
{
    meta:
        description = "VShell files observed by Public Mosaic, matched by SHA-256"
        basis = "hash match; no file bytes held"
        provenance = "file analysis, sandbox run"
        reference = "https://publicmosaic.com/config/endpoint/MjA3LjkwLjIzOC43Nzo4MA"
        generated = "2026-10-31 07:07 UTC"
        tlp = "clear"
    condition:
        hash.sha256(0, filesize) == "189cf73ad00525acd73a24b1400bee3505fe1fd49b6f79882973e37491f855c3"
        or hash.sha256(0, filesize) == "2c059d00803cfce96367464a795f256064055b0894f34ac1c55dcaa2d18ea789"
        or hash.sha256(0, filesize) == "5c09956efcbd977a80cecc12be5b7555e32d75b69d0954d1d313b049762994c7"
        or hash.sha256(0, filesize) == "9b8dd121cb66479f8bc78ae6c414f2d90eca849cc5444f75bf3809bb38321403"
}