// publicmosaic.yar — generated 2026-10-30 22:37 UTC — 1 rule, 4 hashes — TLP:CLEAR
// source: https://publicmosaic.com — published for defensive use
// scope: configuration endpoint — https://publicmosaic.com/config/endpoint/OTEuOTIuMjQyLjM6MjA4Nw
// basis: SHA-256 hash match only; no string or byte patterns.
// Files known only by their Content-Type header are excluded.
import "hash"

rule PublicMosaic_vshell_hashes
{
    meta:
        description = "VShell files observed by Public Mosaic, matched by SHA-256"
        basis = "hash match; no file bytes held"
        provenance = "file analysis, sandbox run"
        reference = "https://publicmosaic.com/config/endpoint/OTEuOTIuMjQyLjM6MjA4Nw"
        generated = "2026-10-30 22:37 UTC"
        tlp = "clear"
    condition:
        hash.sha256(0, filesize) == "9c214200b1e61ba44e0996336e2771c38b556b7034671f14083624803a276a2a"
        or hash.sha256(0, filesize) == "9cdcef555f6afe0e4e2cb00efa76503af19e4dd5ecae7643ff2a78697e81c3b2"
        or hash.sha256(0, filesize) == "aba62c10f01e7f7def97888206e8db2f034a1fa809c4a7cbceb44111a8148bed"
        or hash.sha256(0, filesize) == "eb21028e4c26b1eaf07d2c6122b18a61197b82299f30dda3838cc1ca09f9e703"
}