// publicmosaic.yar — generated 2026-10-31 13:37 UTC — 1 rule, 4 hashes — TLP:CLEAR
// source: https://publicmosaic.com — published for defensive use
// scope: configuration endpoint — https://publicmosaic.com/config/endpoint/NDUuODYuMjI5LjExMTo4MA
// basis: SHA-256 hash match only; no string or byte patterns.
// Files known only by their Content-Type header are excluded.
import "hash"

rule PublicMosaic_vshell_hashes
{
    meta:
        description = "VShell files observed by Public Mosaic, matched by SHA-256"
        basis = "hash match; no file bytes held"
        provenance = "file analysis, sandbox run"
        reference = "https://publicmosaic.com/config/endpoint/NDUuODYuMjI5LjExMTo4MA"
        generated = "2026-10-31 13:37 UTC"
        tlp = "clear"
    condition:
        hash.sha256(0, filesize) == "a1f7e57980aabf68bca560d112248c66f7aae04bb787e676a546f8affbaf83d7"
        or hash.sha256(0, filesize) == "be5cc2c44d2cdb2e9a53d557a77146068a7a8009bbb5adef4c32a77b579e4bce"
        or hash.sha256(0, filesize) == "c3a3e04a39e3fcdf764de3af3e27d027fefbb1233442622c29e6a03c93e534f0"
        or hash.sha256(0, filesize) == "c4687483203bd05255b59a893e818c4b954ba58019d25233f4a564a71e5c537e"
}