# publicmosaic.rules — generated 2026-10-30 18:37 UTC — 192 rules — TLP:CLEAR
# source: https://publicmosaic.com — published for defensive use
# scope: asn 139646 — https://publicmosaic.com/asn/139646
# rev:4 — replace every earlier rule file from this site. Suricata refuses a duplicate sid, so never load an older one beside this one.
# covers listed listeners only; archived listings omitted: 0
# A withdrawal can take up to five minutes to reach this file. Each address's page under publicmosaic.com/ip/ is authoritative.
alert tcp $HOME_NET any -> 156.240.41.3 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.3; sid:9110562; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.4 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.4; sid:9110518; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.5 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.5; sid:9110568; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.6 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.6; sid:9110541; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.8 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.8; sid:9110520; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.9 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.9; sid:9110523; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.11 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.11; sid:9110560; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.13 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.13; sid:9110652; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.15 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.15; sid:9110511; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.16 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.16; sid:9110602; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.17 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.17; sid:9110594; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.18 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.18; sid:9110616; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.19 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.19; sid:9110644; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.20 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.20; sid:9110629; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.21 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.21; sid:9110601; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.26 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.26; sid:9110546; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.27 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.27; sid:9110588; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.28 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.28; sid:9110569; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.29 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.29; sid:9110531; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.31 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.31; sid:9110566; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.32 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.32; sid:9110504; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.34 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.34; sid:9110587; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.35 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.35; sid:9110586; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.37 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.37; sid:9110584; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.39 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.39; sid:9110583; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.40 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.40; sid:9110514; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.42 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.42; sid:9110498; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.43 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.43; sid:9110524; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.47 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.47; sid:9110548; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.48 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.48; sid:9110581; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.49 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.49; sid:9110567; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.50 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.50; sid:9110508; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.51 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.51; sid:9110565; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.52 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.52; sid:9110543; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.54 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.54; sid:9110490; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.55 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.55; sid:9110573; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.57 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.57; sid:9110558; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.58 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.58; sid:9110559; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.59 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.59; sid:9110506; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.60 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.60; sid:9110554; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.61 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.61; sid:9110499; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.63 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.63; sid:9110536; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.65 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.65; sid:9110496; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.66 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.66; sid:9110525; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.71 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.71; sid:9110552; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.72 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.72; sid:9110512; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.74 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.74; sid:9110561; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.75 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.75; sid:9110535; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.77 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.77; sid:9110497; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.78 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.78; sid:9110491; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.79 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.79; sid:9110534; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.81 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.81; sid:9110537; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.82 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.82; sid:9110527; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.83 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.83; sid:9110556; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.84 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.84; sid:9110550; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.85 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.85; sid:9110502; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.86 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.86; sid:9110501; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.88 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.88; sid:9110519; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.89 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.89; sid:9110500; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.90 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.90; sid:9110503; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.91 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.91; sid:9110526; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.92 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.92; sid:9110553; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.93 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.93; sid:9110544; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.94 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.94; sid:9110540; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.95 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.95; sid:9110403; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.96 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.96; sid:9110516; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.97 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.97; sid:9110489; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.98 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.98; sid:9110542; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.99 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.99; sid:9110545; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.100 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.100; sid:9110677; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.101 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.101; sid:9110676; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.102 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.102; sid:9110675; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.104 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.104; sid:9110674; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.105 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.105; sid:9110664; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.107 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.107; sid:9110509; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.108 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.108; sid:9110655; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.109 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.109; sid:9110670; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.110 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.110; sid:9110668; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.111 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.111; sid:9110669; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.112 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.112; sid:9110610; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.113 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.113; sid:9110614; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.114 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.114; sid:9110607; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.115 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.115; sid:9110636; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.117 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.117; sid:9110673; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.118 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.118; sid:9110663; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.120 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.120; sid:9110671; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.123 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.123; sid:9110672; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.124 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.124; sid:9110590; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.125 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.125; sid:9110570; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.126 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.126; sid:9110666; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.128 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.128; sid:9110645; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.129 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.129; sid:9110571; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.130 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.130; sid:9110612; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.131 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.131; sid:9110667; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.132 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.132; sid:9110658; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.133 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.133; sid:9110620; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.134 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.134; sid:9110665; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.135 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.135; sid:9110650; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.136 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.136; sid:9110654; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.137 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.137; sid:9110633; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.139 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.139; sid:9110639; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.140 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.140; sid:9110662; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.142 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.142; sid:9110661; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.143 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.143; sid:9110641; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.144 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.144; sid:9110515; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.145 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.145; sid:9110642; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.146 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.146; sid:9110660; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.147 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.147; sid:9110549; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.148 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.148; sid:9110528; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.149 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.149; sid:9110631; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.150 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.150; sid:9110621; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.151 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.151; sid:9110634; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.153 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.153; sid:9110659; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.154 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.154; sid:9110563; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.155 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.155; sid:9110657; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.157 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.157; sid:9110638; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.158 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.158; sid:9110577; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.159 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.159; sid:9110622; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.160 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.160; sid:9110615; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.161 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.161; sid:9110649; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.164 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.164; sid:9110522; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.166 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.166; sid:9110651; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.168 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.168; sid:9110405; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.169 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.169; sid:9110626; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.170 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.170; sid:9110630; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.171 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.171; sid:9110623; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.172 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.172; sid:9110619; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.173 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.173; sid:9110656; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.175 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.175; sid:9110592; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.177 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.177; sid:9110532; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.178 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.178; sid:9110648; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.179 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.179; sid:9110653; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.180 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.180; sid:9110646; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.181 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.181; sid:9110492; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.182 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.182; sid:9110538; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.183 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.183; sid:9110643; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.184 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.184; sid:9110576; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.185 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.185; sid:9110603; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.186 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.186; sid:9110611; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.187 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.187; sid:9110596; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.189 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.189; sid:9110505; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.190 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.190; sid:9110557; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.191 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.191; sid:9110647; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.193 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.193; sid:9110624; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.195 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.195; sid:9110605; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.197 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.197; sid:9110404; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.198 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.198; sid:9110635; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.200 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.200; sid:9110640; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.201 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.201; sid:9110494; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.202 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.202; sid:9110618; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.203 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.203; sid:9110632; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.204 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.204; sid:9110627; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.205 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.205; sid:9110628; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.206 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.206; sid:9110575; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.207 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.207; sid:9110598; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.208 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.208; sid:9110617; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.210 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.210; sid:9110637; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.211 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.211; sid:9110574; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.212 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.212; sid:9110613; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.213 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.213; sid:9110555; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.214 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.214; sid:9110564; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.215 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.215; sid:9110529; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.216 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.216; sid:9110597; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.217 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.217; sid:9110625; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.218 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.218; sid:9110585; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.219 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.219; sid:9110551; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.221 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.221; sid:9110517; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.222 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.222; sid:9110493; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.223 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.223; sid:9110507; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.224 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.224; sid:9110510; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.225 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.225; sid:9110609; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.227 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.227; sid:9110547; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.228 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.228; sid:9110572; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.229 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.229; sid:9110530; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.230 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.230; sid:9110608; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.232 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.232; sid:9110595; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.233 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.233; sid:9110606; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.234 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.234; sid:9110604; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.235 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.235; sid:9110533; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.237 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.237; sid:9110579; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.238 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.238; sid:9110600; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.239 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.239; sid:9110589; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.241 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.241; sid:9110521; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.242 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.242; sid:9110578; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.243 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.243; sid:9110513; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.244 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.244; sid:9110599; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.245 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.245; sid:9110539; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.248 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.248; sid:9110593; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.250 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.250; sid:9110582; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.251 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.251; sid:9110495; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.252 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.252; sid:9110591; rev:4;)
alert tcp $HOME_NET any -> 156.240.41.253 8877 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/156.240.41.253; sid:9110580; rev:4;)