// publicmosaic.yar — generated 2026-10-30 20:37 UTC — 1 rule, 3 hashes — TLP:CLEAR
// source: https://publicmosaic.com — published for defensive use
// scope: configuration endpoint — https://publicmosaic.com/config/endpoint/NDcuOTYuMTM3LjcyOjgwODQ
// basis: SHA-256 hash match only; no string or byte patterns.
// Files known only by their Content-Type header are excluded.
import "hash"

rule PublicMosaic_vshell_hashes
{
    meta:
        description = "VShell files observed by Public Mosaic, matched by SHA-256"
        basis = "hash match; no file bytes held"
        provenance = "file analysis"
        reference = "https://publicmosaic.com/config/endpoint/NDcuOTYuMTM3LjcyOjgwODQ"
        generated = "2026-10-30 20:37 UTC"
        tlp = "clear"
    condition:
        hash.sha256(0, filesize) == "40e382c9578c8d395bc0eb50f66ba1de4f4a47264c039ca5aa6c8ccf8411ac94"
        or hash.sha256(0, filesize) == "453aee54e0c38177f987e6f62e463cc6fbd814adb8653fd156d358e83b99aac7"
        or hash.sha256(0, filesize) == "5a643772cb85d889ddee9c0cd241c64f1478125cfdbdffd68863eaec3f727377"
}