// publicmosaic.yar — generated 2026-10-30 21:07 UTC — 1 rule, 4 hashes — TLP:CLEAR
// source: https://publicmosaic.com — published for defensive use
// scope: configuration endpoint — https://publicmosaic.com/config/endpoint/NjguNjQuMTc3LjMyOjgwODA
// basis: SHA-256 hash match only; no string or byte patterns.
// Files known only by their Content-Type header are excluded.
import "hash"

rule PublicMosaic_vshell_hashes
{
    meta:
        description = "VShell files observed by Public Mosaic, matched by SHA-256"
        basis = "hash match; no file bytes held"
        provenance = "file analysis, sandbox run"
        reference = "https://publicmosaic.com/config/endpoint/NjguNjQuMTc3LjMyOjgwODA"
        generated = "2026-10-30 21:07 UTC"
        tlp = "clear"
    condition:
        hash.sha256(0, filesize) == "8c1a75f1cc8d57941e030077e2c19910e464e5635066acf8fda96d0972ee9a39"
        or hash.sha256(0, filesize) == "ddbe46b31b7c9ee91020d262aec1c76fa594c42bf2fe173a5d2ae7c5f97215dd"
        or hash.sha256(0, filesize) == "e5359a4aa35d9b67ed961799b153e1fc3c3dc6410689da950416eeee1d9ed081"
        or hash.sha256(0, filesize) == "fd1846b804dffdeb2d976bff896c3aad545c703b1793a8e753de4bc1bcb1f185"
}