// publicmosaic.yar — generated 2026-10-30 22:07 UTC — 1 rule, 4 hashes — TLP:CLEAR
// source: https://publicmosaic.com — published for defensive use
// scope: configuration endpoint — https://publicmosaic.com/config/endpoint/MzguMTQuMjQ4LjE2MTo5ODg5
// basis: SHA-256 hash match only; no string or byte patterns.
// Files known only by their Content-Type header are excluded.
import "hash"

rule PublicMosaic_vshell_hashes
{
    meta:
        description = "VShell files observed by Public Mosaic, matched by SHA-256"
        basis = "hash match; no file bytes held"
        provenance = "file analysis, sandbox run"
        reference = "https://publicmosaic.com/config/endpoint/MzguMTQuMjQ4LjE2MTo5ODg5"
        generated = "2026-10-30 22:07 UTC"
        tlp = "clear"
    condition:
        hash.sha256(0, filesize) == "41ea1efb01f64dcea4fc9c059710f745ab62b34606c5ba9aa42f8a144841abc7"
        or hash.sha256(0, filesize) == "af04bafd6bd1aa6305050accc7c60f0e2f45302c3328cb0b9ea8437f5bd10abc"
        or hash.sha256(0, filesize) == "db6ed2a2865948d4a3fe1b2c1ec4afe5fd77aba62472cab48ee1709155ed7e78"
        or hash.sha256(0, filesize) == "fa1d37a3bbcf2886aeb23b8f9b1ff81f9668534db905826518e9b1eb53dbdd06"
}