// publicmosaic.yar — generated 2026-10-31 02:37 UTC — 1 rule, 4 hashes — TLP:CLEAR
// source: https://publicmosaic.com — published for defensive use
// scope: configuration endpoint — https://publicmosaic.com/config/endpoint/ODguMjE4Ljc2LjIwMTo4ODg5
// basis: SHA-256 hash match only; no string or byte patterns.
// Files known only by their Content-Type header are excluded.
import "hash"

rule PublicMosaic_vshell_hashes
{
    meta:
        description = "VShell files observed by Public Mosaic, matched by SHA-256"
        basis = "hash match; no file bytes held"
        provenance = "file analysis, sandbox run"
        reference = "https://publicmosaic.com/config/endpoint/ODguMjE4Ljc2LjIwMTo4ODg5"
        generated = "2026-10-31 02:37 UTC"
        tlp = "clear"
    condition:
        hash.sha256(0, filesize) == "134f8d35ec2aa1bd3e95e93007140edc8ce6710db77fad9de280018cd5e85629"
        or hash.sha256(0, filesize) == "1ff7073be533cf5d48cf1677f79f78b67cb457d94e23907b46a3df2698371916"
        or hash.sha256(0, filesize) == "28b829db665186b36fac0f5439353ae2c7f45d5d9bbbb14a9afcf2d4c83dda06"
        or hash.sha256(0, filesize) == "316b2cce669628c1657f2297aa42d4bc733be1df9e9c7afb37a38f6a1d0d1232"
}