// publicmosaic.yar — generated 2026-10-30 22:07 UTC — 1 rule, 4 hashes — TLP:CLEAR
// source: https://publicmosaic.com — published for defensive use
// scope: configuration endpoint — https://publicmosaic.com/config/endpoint/MzEuNy42Mi4xNzg6MTI1ODE
// basis: SHA-256 hash match only; no string or byte patterns.
// Files known only by their Content-Type header are excluded.
import "hash"

rule PublicMosaic_vshell_hashes
{
    meta:
        description = "VShell files observed by Public Mosaic, matched by SHA-256"
        basis = "hash match; no file bytes held"
        provenance = "file analysis, sandbox run"
        reference = "https://publicmosaic.com/config/endpoint/MzEuNy42Mi4xNzg6MTI1ODE"
        generated = "2026-10-30 22:07 UTC"
        tlp = "clear"
    condition:
        hash.sha256(0, filesize) == "473d509b4ff7c743153f14b04d527b7c4c8952c5d4d6749a223beb811b31d2cf"
        or hash.sha256(0, filesize) == "8578cc8ab74af7bd5566d3ec990b7867b978fed4aafb8deaf767f1f9a54d1dbf"
        or hash.sha256(0, filesize) == "9111e14f92f8dcb850d13a69510a2e2ba5dec305da0065b2d3ab1c68ff539a2d"
        or hash.sha256(0, filesize) == "b2ed52ffe0f35178622a2865a4f499001d4f6a79770abcf02401584c1f5e9ba6"
}