// publicmosaic.yar — generated 2026-10-30 23:07 UTC — 1 rule, 4 hashes — TLP:CLEAR
// source: https://publicmosaic.com — published for defensive use
// scope: configuration endpoint — https://publicmosaic.com/config/endpoint/MzguNjAuMjQxLjI1MTo0NDQz
// basis: SHA-256 hash match only; no string or byte patterns.
// Files known only by their Content-Type header are excluded.
import "hash"

rule PublicMosaic_vshell_hashes
{
    meta:
        description = "VShell files observed by Public Mosaic, matched by SHA-256"
        basis = "hash match; no file bytes held"
        provenance = "file analysis, sandbox run"
        reference = "https://publicmosaic.com/config/endpoint/MzguNjAuMjQxLjI1MTo0NDQz"
        generated = "2026-10-30 23:07 UTC"
        tlp = "clear"
    condition:
        hash.sha256(0, filesize) == "3e8385a321412f820a33758e4c152a3663e0178eefb460fe07e8b0d791d76f42"
        or hash.sha256(0, filesize) == "6b03225ff75d5e8e3e1efe7e94256192bfe5ffcf33db4c9d6220ffe829b9f3e7"
        or hash.sha256(0, filesize) == "c528061b973f7d6fb2595c53404b2fb66a6e9dadf4a9113ffdd6cadb0a4ab129"
        or hash.sha256(0, filesize) == "e861a7185d6fe90bed8de30c2d9d0ad8f4c960861edc271d9ac6c439f8226a8b"
}