// publicmosaic.yar — generated 2026-10-31 00:37 UTC — 1 rule, 4 hashes — TLP:CLEAR
// source: https://publicmosaic.com — published for defensive use
// scope: configuration endpoint — https://publicmosaic.com/config/endpoint/MzguNTUuMTA3LjE5OjQ0Mw
// basis: SHA-256 hash match only; no string or byte patterns.
// Files known only by their Content-Type header are excluded.
import "hash"

rule PublicMosaic_vshell_hashes
{
    meta:
        description = "VShell files observed by Public Mosaic, matched by SHA-256"
        basis = "hash match; no file bytes held"
        provenance = "file analysis, sandbox run"
        reference = "https://publicmosaic.com/config/endpoint/MzguNTUuMTA3LjE5OjQ0Mw"
        generated = "2026-10-31 00:37 UTC"
        tlp = "clear"
    condition:
        hash.sha256(0, filesize) == "1c23c5ebbb8dad4da1131392eb7a282f7000d2469cc64af24d74ce257e16e348"
        or hash.sha256(0, filesize) == "762624b220653b1d1f7fb3b5bf7869bc219c50d1b886579d3802bf2655364992"
        or hash.sha256(0, filesize) == "a01a5cb372efb89596a2b43abb7ab693871158a553e208210ba44cb8c006ef43"
        or hash.sha256(0, filesize) == "fa6b952eb21f88e72de3991d791fff8714f0c45c57ffaa6374e6e90a55e4dfbf"
}