// publicmosaic.yar — generated 2026-10-31 00:37 UTC — 1 rule, 4 hashes — TLP:CLEAR
// source: https://publicmosaic.com — published for defensive use
// scope: configuration endpoint — https://publicmosaic.com/config/endpoint/MjMuOTUuMjQyLjU1Ojg0NDM
// basis: SHA-256 hash match only; no string or byte patterns.
// Files known only by their Content-Type header are excluded.
import "hash"

rule PublicMosaic_vshell_hashes
{
    meta:
        description = "VShell files observed by Public Mosaic, matched by SHA-256"
        basis = "hash match; no file bytes held"
        provenance = "file analysis, sandbox run"
        reference = "https://publicmosaic.com/config/endpoint/MjMuOTUuMjQyLjU1Ojg0NDM"
        generated = "2026-10-31 00:37 UTC"
        tlp = "clear"
    condition:
        hash.sha256(0, filesize) == "307b3da045c4cc62860cdad9a6f153d067ce24e6314918e4e50e4c9baf843cc8"
        or hash.sha256(0, filesize) == "898b78ceae102bab13f4074c9474b027e3e50acebd7645e9cd781eff121988b6"
        or hash.sha256(0, filesize) == "d0772b130e0b7baf3047a1a6fce4ce51f1ad27918a68f307c30618cfc2712763"
        or hash.sha256(0, filesize) == "d9c3e3544d58ff5d83e0f365a580fd19a7ee4f291ba02035162f71cf00980c8d"
}