// publicmosaic.yar — generated 2026-10-31 06:37 UTC — 1 rule, 4 hashes — TLP:CLEAR
// source: https://publicmosaic.com — published for defensive use
// scope: configuration endpoint — https://publicmosaic.com/config/endpoint/NDUuNzcuMjguNDA6NDQz
// basis: SHA-256 hash match only; no string or byte patterns.
// Files known only by their Content-Type header are excluded.
import "hash"

rule PublicMosaic_vshell_hashes
{
    meta:
        description = "VShell files observed by Public Mosaic, matched by SHA-256"
        basis = "hash match; no file bytes held"
        provenance = "file analysis, sandbox run"
        reference = "https://publicmosaic.com/config/endpoint/NDUuNzcuMjguNDA6NDQz"
        generated = "2026-10-31 06:37 UTC"
        tlp = "clear"
    condition:
        hash.sha256(0, filesize) == "22372c25b0d56d417ca0f980225ab4ef064c676b36ca871db6215d0f15305a8b"
        or hash.sha256(0, filesize) == "5f6f6083b3922987b40d897e371131ae6fbf6ba2b7f5f8822ad7abf64cd07d35"
        or hash.sha256(0, filesize) == "9beb8fc21e0506fd99d5356a772a60115c9d3a78f17d5b4a39c3bb83ebba4a38"
        or hash.sha256(0, filesize) == "bf41cd90196a181faf30421c01f0dcca6535077c5706458fbb5c70e242c6901c"
}