# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 186 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: asn 14061 — https://publicmosaic.com/asn/14061
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 0
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tls $HOME_NET any -> 24.144.82.16 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"56617bd8278bbbf7378642d21e1e7529c7c721fbe00c130f7811f05471585f81"; reference:url,publicmosaic.com/indicators; sid:9100408; rev:2;)
alert tls $HOME_NET any -> 24.199.90.142 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"4eb1323d5b67996a42f607d347e1dd58cb2f673ea3429496db60b944dabbd3b6"; reference:url,publicmosaic.com/indicators; sid:9101508; rev:2;)
alert tls $HOME_NET any -> 46.101.64.237 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"04e50f0d2cf7b67487c0b0c34abb09a61858541f62618b4732a5be197f2487ed"; reference:url,publicmosaic.com/indicators; sid:9100392; rev:2;)
alert tcp $HOME_NET any -> 46.101.85.81 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9101620; rev:2;)
alert tls $HOME_NET any -> 64.23.139.223 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"441d38020bfefcba7d86348e01d943203ed36b07ca70b8ce17bc90c58312abe1"; reference:url,publicmosaic.com/indicators; sid:9100378; rev:2;)
alert tls $HOME_NET any -> 64.23.184.180 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"2a2dd98a32976d364e644fa97b0c81d99d7c394e66530fd5abf4abd812411ef6"; reference:url,publicmosaic.com/indicators; sid:9100374; rev:2;)
alert tls $HOME_NET any -> 64.23.192.235 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"a7ed9201558859d7859001f841cb55a08c23dfd10aa896bfff3eace2841c3571"; reference:url,publicmosaic.com/indicators; sid:9100713; rev:2;)
alert tls $HOME_NET any -> 64.23.192.235 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"7ff9aab4bf0032576495fefdef8a08aa5a31386d3508713ee7bfc212cd9e15f8"; reference:url,publicmosaic.com/indicators; sid:9100376; rev:2;)
alert tls $HOME_NET any -> 64.23.254.205 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"c19c15a70711482722723913180d67e3e984aba6bdbf6a4063ba468bde68f8ee"; reference:url,publicmosaic.com/indicators; sid:9104219; rev:2;)
alert tls $HOME_NET any -> 64.23.254.205 8443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"c19c15a70711482722723913180d67e3e984aba6bdbf6a4063ba468bde68f8ee"; reference:url,publicmosaic.com/indicators; sid:9103699; rev:2;)
alert tls $HOME_NET any -> 64.23.254.205 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"5851efc83ae587d18f8b30ee706e558c8b483ee6061ad5f792d18552d679332c"; reference:url,publicmosaic.com/indicators; sid:9103698; rev:2;)
alert tls $HOME_NET any -> 64.225.28.168 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"01204de12235a4e2c6326d55232df794c7aa361598ae1392106812593094576e"; reference:url,publicmosaic.com/indicators; sid:9102196; rev:2;)
alert tls $HOME_NET any -> 64.227.87.165 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"b2ebd94264585e370dfa54bc24ec1a19803f55fb34d87a5f7d7901728abc7c18"; reference:url,publicmosaic.com/indicators; sid:9100373; rev:2;)
alert tls $HOME_NET any -> 64.227.105.70 8080 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"7b0e3a0a7348caef577425a26dac71ce950e1f57cc63f3ce1a23cc8623a2699c"; reference:url,publicmosaic.com/indicators; sid:9100558; rev:2;)
alert tls $HOME_NET any -> 64.227.159.29 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"43bf4be099211389e2e4da6d77943117243331343661de2bd6932043fa9ad229"; reference:url,publicmosaic.com/indicators; sid:9100536; rev:2;)
alert tls $HOME_NET any -> 67.205.154.243 36825 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"56a74bcdb336f28d46321e930facf7408e2f4d14c2c32c1a13c18ca69e302c6c"; reference:url,publicmosaic.com/indicators; sid:9104964; rev:2;)
alert tls $HOME_NET any -> 67.205.157.105 443 (msg:"HOLLOWPOINT C2 metasploit"; tls.cert_fingerprint; content:"7730c189a5c0cc4a5da13739d7f0704d4ab3483531cbc23833acda044ffe852e"; reference:url,publicmosaic.com/indicators; sid:9103928; rev:2;)
alert tls $HOME_NET any -> 67.205.159.107 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"88291427729e68ca28aa65b250a058ca92326417fd08182d977855cd25de37ba"; reference:url,publicmosaic.com/indicators; sid:9101644; rev:2;)
alert tcp $HOME_NET any -> 67.207.81.22 5433 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9103326; rev:2;)
alert tls $HOME_NET any -> 68.183.144.101 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"708fab8c575a06b53ca845d227b7df8de41a82d1774841d023be391c245b82bd"; reference:url,publicmosaic.com/indicators; sid:9103697; rev:2;)
alert tcp $HOME_NET any -> 68.183.147.242 80 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100966; rev:2;)
alert tcp $HOME_NET any -> 68.183.147.242 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100964; rev:2;)
alert tcp $HOME_NET any -> 68.183.147.242 8080 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100965; rev:2;)
alert tls $HOME_NET any -> 68.183.248.32 4443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"9230c9fa48d68de48c55faccdf1d5547c3794752e5b2965406dd4e8cc139f884"; reference:url,publicmosaic.com/indicators; sid:9104194; rev:2;)
alert tls $HOME_NET any -> 104.131.25.122 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"5b25a2767c5522c964955d01be599b9873430dfad1081876f943995b27cfdc9f"; reference:url,publicmosaic.com/indicators; sid:9100609; rev:2;)
alert tls $HOME_NET any -> 104.131.164.51 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"bd27296d7a32e193ea6e51b4468b87cc4423df3ba6b53810836e0d7b4fbe3092"; reference:url,publicmosaic.com/indicators; sid:9104251; rev:2;)
alert tls $HOME_NET any -> 104.236.230.184 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"959a3c71adb986115ca08a6adc133db678ee675a5e218a2738639cc09f8b10a4"; reference:url,publicmosaic.com/indicators; sid:9100357; rev:2;)
alert tls $HOME_NET any -> 104.248.69.160 65000 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"b599a50031b4d09a43536eb75060e97b939250674c5a45965996c709860110d8"; reference:url,publicmosaic.com/indicators; sid:9100549; rev:2;)
alert tcp $HOME_NET any -> 104.248.78.108 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9101618; rev:2;)
alert tcp $HOME_NET any -> 104.248.156.16 80 (msg:"HOLLOWPOINT C2 havoc"; reference:url,publicmosaic.com/indicators; sid:9106834; rev:2;)
alert tls $HOME_NET any -> 104.248.156.16 443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"5ed089289ea8b3ced194bbfbf59795a1c2ba512cab77d93f16d690b16a589a02"; reference:url,publicmosaic.com/indicators; sid:9106390; rev:2;)
alert tls $HOME_NET any -> 104.248.156.16 40056 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"0857c9e7d25a6fbc8b269c3bc476a9d37e6de8b381818beb0ea3a689504d8b06"; reference:url,publicmosaic.com/indicators; sid:9106833; rev:2;)
alert tls $HOME_NET any -> 104.248.163.130 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"05c7761738dcf640eb5f53ff41bf852190db3a6d4d336de5a2b25828289cb6bd"; reference:url,publicmosaic.com/indicators; sid:9100356; rev:2;)
alert tls $HOME_NET any -> 104.248.229.157 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"687c96413eac5cba6950bd966a7545739530e8613b98b110fc9bce2e2df0ed20"; reference:url,publicmosaic.com/indicators; sid:9101943; rev:2;)
alert tcp $HOME_NET any -> 107.170.50.250 80 (msg:"HOLLOWPOINT C2 adaptix"; reference:url,publicmosaic.com/indicators; sid:9100656; rev:2;)
alert tls $HOME_NET any -> 134.122.123.227 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"8172ee65e50dff56a12967746d53d3d8019c8f9875ebb81a6ee679dddb005178"; reference:url,publicmosaic.com/indicators; sid:9100433; rev:2;)
alert tls $HOME_NET any -> 134.209.41.160 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"4faf512e1a2838463c6d774659699bd4de28ad191c6ad81526e839f121a42809"; reference:url,publicmosaic.com/indicators; sid:9100528; rev:2;)
alert tls $HOME_NET any -> 134.209.93.110 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"68cb3831a6e7791d52dd7b97267e1dab914617a0750c19999c4ee5a60bbd97f0"; reference:url,publicmosaic.com/indicators; sid:9100345; rev:2;)
alert tls $HOME_NET any -> 134.209.112.52 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"666b3b08111c37913a424cad3cc240f90785b4aebd67abf8b9d3195d255008ff"; reference:url,publicmosaic.com/indicators; sid:9100790; rev:2;)
alert tls $HOME_NET any -> 134.209.146.147 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"822eb116bcb85addfd4e9e0d9dbd38d6d828543c5b7d0307190250f8c9979b1f"; reference:url,publicmosaic.com/indicators; sid:9100530; rev:2;)
alert tls $HOME_NET any -> 134.209.213.17 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"2e02d72d464625280fa7097e5f559f7049293e87a0d74581709aa1400d7b0ed9"; reference:url,publicmosaic.com/indicators; sid:9101973; rev:2;)
alert tcp $HOME_NET any -> 134.209.214.178 8088 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9100949; rev:2;)
alert tls $HOME_NET any -> 137.184.56.42 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"75a7d9f2b0c4145da8572961218e79e0d24c09d2da45a60884902c2fe91e6e0c"; reference:url,publicmosaic.com/indicators; sid:9105859; rev:2;)
alert tls $HOME_NET any -> 137.184.57.89 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"83722f9fc34f1afed670032fa8f94b4ba6a40fcda579fb0422e619805fb29f62"; reference:url,publicmosaic.com/indicators; sid:9100342; rev:2;)
alert tls $HOME_NET any -> 137.184.139.185 443 (msg:"HOLLOWPOINT C2 poshc2"; tls.cert_fingerprint; content:"ae6f95692b2dfa9d33349dc1b80aa8dbed27d0288434bf886b657c8cf019fea9"; reference:url,publicmosaic.com/indicators; sid:9104518; rev:2;)
alert tls $HOME_NET any -> 137.184.163.27 443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"2828aa780721634676bc349c1995304111653ff2fa60fb222733765da73fd957"; reference:url,publicmosaic.com/indicators; sid:9100547; rev:2;)
alert tls $HOME_NET any -> 137.184.163.27 5613 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"73097465003234dbb7f0857f20a79f45dac4dfebb6b6e3fa92af8c1467460b8a"; reference:url,publicmosaic.com/indicators; sid:9103337; rev:2;)
alert tcp $HOME_NET any -> 137.184.197.155 80 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9101604; rev:2;)
alert tcp $HOME_NET any -> 138.68.63.206 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9101699; rev:2;)
alert tls $HOME_NET any -> 138.68.170.98 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"f740834113e0687f7c55c27e06dc1af8941f8938b6af5d6350b96e0d041eb438"; reference:url,publicmosaic.com/indicators; sid:9100341; rev:2;)
alert tls $HOME_NET any -> 138.68.180.119 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"04e50f0d2cf7b67487c0b0c34abb09a61858541f62618b4732a5be197f2487ed"; reference:url,publicmosaic.com/indicators; sid:9100340; rev:2;)
alert tls $HOME_NET any -> 138.197.84.20 443 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"d3f2da36a441c1ccd110229223a7720e00f6d7e76525ea8cb0ceae494181f362"; reference:url,publicmosaic.com/indicators; sid:9102055; rev:2;)
alert tls $HOME_NET any -> 138.197.84.20 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"02da795080fc01af4a0f00adc248383be13a5d1b93d1273fe7b5abf6523e573d"; reference:url,publicmosaic.com/indicators; sid:9102054; rev:2;)
alert tls $HOME_NET any -> 138.197.224.55 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"83722f9fc34f1afed670032fa8f94b4ba6a40fcda579fb0422e619805fb29f62"; reference:url,publicmosaic.com/indicators; sid:9100339; rev:2;)
alert tls $HOME_NET any -> 139.59.23.248 57338 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"5b1b4ce8f02f0f5d9e11c28425ded704647a9392e8f247729b37c66cf21af826"; reference:url,publicmosaic.com/indicators; sid:9102255; rev:2;)
alert tls $HOME_NET any -> 142.93.4.32 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"026a31ce9814d84572a719b544ca3cdccf75ac9bd3d991184483e9c36ad9b4c6"; reference:url,publicmosaic.com/indicators; sid:9101039; rev:2;)
alert tls $HOME_NET any -> 142.93.51.224 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"2e627a8af8d9791b8b5bd88e194a94478ad4c4e3db2cae2d1f8854de1c248459"; reference:url,publicmosaic.com/indicators; sid:9103397; rev:2;)
alert tls $HOME_NET any -> 142.93.52.11 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"0c90154fd7a7e9bdad0c698d9092e503c978ec71c7b702e7b0e0e24fb192a907"; reference:url,publicmosaic.com/indicators; sid:9100527; rev:2;)
alert tls $HOME_NET any -> 142.93.58.98 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"554a671de6fc0fddc30143b8f836fb8b5e6b8c1a3e1cb56f5b2eb5fe6d8c9461"; reference:url,publicmosaic.com/indicators; sid:9106618; rev:2;)
alert tls $HOME_NET any -> 142.93.88.220 443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"69755dc2542b7d7e2117744751933553c615c877be7df0ede6f4fff41b8176ce"; reference:url,publicmosaic.com/indicators; sid:9100578; rev:2;)
alert tls $HOME_NET any -> 142.93.162.87 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"9f51e1b13460a633ad8b6ce6a414c18c190698e7c92778ce8b59aad507e6907e"; reference:url,publicmosaic.com/indicators; sid:9105336; rev:2;)
alert tls $HOME_NET any -> 142.93.162.87 8080 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"4d37cae74b91bd1e85eb9f37d88e7353f3f275c7f9bbd1af3dfc0382dfdf1352"; reference:url,publicmosaic.com/indicators; sid:9106010; rev:2;)
alert tcp $HOME_NET any -> 143.110.180.148 443 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9106732; rev:2;)
alert tls $HOME_NET any -> 143.198.1.58 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"7af552d55bf091ac26fc98a9d85a6fec926dfb3167de39bab6adbf5185e84b44"; reference:url,publicmosaic.com/indicators; sid:9100338; rev:2;)
alert tcp $HOME_NET any -> 143.198.84.113 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9101609; rev:2;)
alert tcp $HOME_NET any -> 143.198.120.167 80 (msg:"HOLLOWPOINT C2 havoc"; reference:url,publicmosaic.com/indicators; sid:9100575; rev:2;)
alert tls $HOME_NET any -> 143.198.120.167 40056 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"bd30c1c4afd5950d0eb41777c07a167f7edfeccf037eae20b19d6d5435522584"; reference:url,publicmosaic.com/indicators; sid:9105681; rev:2;)
alert tls $HOME_NET any -> 143.198.125.30 4443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"56f154fb79978f1a87234ff20ca1c0654df618ec8d7477f86e4543696ae594a6"; reference:url,publicmosaic.com/indicators; sid:9100337; rev:2;)
alert tls $HOME_NET any -> 143.198.136.6 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"3556ffe9a9c93cfd534ac894e5f77f561fe11145227b8c1d86b901792f2f2a32"; reference:url,publicmosaic.com/indicators; sid:9100336; rev:2;)
alert tls $HOME_NET any -> 143.198.149.226 8443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"d899c7d0b407118534bb61a7aeff368df39db5a13fa04ad6a7d0f2f027d0eaea"; reference:url,publicmosaic.com/indicators; sid:9104972; rev:2;)
alert tls $HOME_NET any -> 143.198.149.226 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"f0144a26ae0c9d9e5d9d7783b1a9de70001e1d14df0cd19fcc229c2f9fb03b73"; reference:url,publicmosaic.com/indicators; sid:9100335; rev:2;)
alert tcp $HOME_NET any -> 143.244.214.44 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9101592; rev:2;)
alert tls $HOME_NET any -> 144.126.210.142 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"8c00100c9d554771d2298441edd1fe630b408baa4942f6257e4f571f24dadd91"; reference:url,publicmosaic.com/indicators; sid:9104238; rev:2;)
alert tls $HOME_NET any -> 144.126.210.142 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"77c3958861bb2afb24bfcd6acd136b27e78e3a360049f8a8fd3da74dc2eb19d1"; reference:url,publicmosaic.com/indicators; sid:9103686; rev:2;)
alert tls $HOME_NET any -> 146.190.17.255 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"f21de01635c0ae0ea4c435c81b6cfad066cec05b8ea2e7ab14fb4bfe3e0b4600"; reference:url,publicmosaic.com/indicators; sid:9103685; rev:2;)
alert tls $HOME_NET any -> 146.190.80.105 443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"28af1dad02e5edf428670e964dccbe0882e181480321f0f3c311dcdde4e94ca4"; reference:url,publicmosaic.com/indicators; sid:9100567; rev:2;)
alert tls $HOME_NET any -> 146.190.80.105 40056 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"d786e9d07d111f586b8312a6c411917ce0d3810f2ea6f510c70aaad2bae13287"; reference:url,publicmosaic.com/indicators; sid:9105680; rev:2;)
alert tcp $HOME_NET any -> 146.190.127.76 10000 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102373; rev:2;)
alert tcp $HOME_NET any -> 146.190.127.173 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9101702; rev:2;)
alert tcp $HOME_NET any -> 146.190.154.156 80 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9103314; rev:2;)
alert tcp $HOME_NET any -> 146.190.190.101 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9103861; rev:2;)
alert tls $HOME_NET any -> 146.190.215.221 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"03ed728076d2fa72d04a4e7e3fe0b3d3fb47de63f50c37ce9d9e0b653b5a073b"; reference:url,publicmosaic.com/indicators; sid:9102051; rev:2;)
alert tls $HOME_NET any -> 152.42.172.222 9898 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"22107e9685937784e7ce13087d9962971ef074d3be6df88512db3d980775fefc"; reference:url,publicmosaic.com/indicators; sid:9105201; rev:2;)
alert tls $HOME_NET any -> 152.42.174.192 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"eca65821089eeec29de25292bba6df135793686a9b68512ce450873eaa747e04"; reference:url,publicmosaic.com/indicators; sid:9100645; rev:2;)
alert tls $HOME_NET any -> 152.42.180.208 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"1cbe87bcea1ec835b1df1ebb65f808478babb56715de65a3100db59d1a10385d"; reference:url,publicmosaic.com/indicators; sid:9102281; rev:2;)
alert tcp $HOME_NET any -> 152.42.180.208 8875 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9101984; rev:2;)
alert tls $HOME_NET any -> 152.42.185.244 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9102225; rev:2;)
alert tls $HOME_NET any -> 152.42.207.101 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"230cfd878c159eb7f95599831724e4b1ec923928f8726949f3cb26edb00f62dc"; reference:url,publicmosaic.com/indicators; sid:9103683; rev:2;)
alert tcp $HOME_NET any -> 152.42.211.112 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102351; rev:2;)
alert tcp $HOME_NET any -> 152.42.211.112 14357 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102350; rev:2;)
alert tls $HOME_NET any -> 152.42.214.0 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"d9bc1819ddfa812f0728c67d2ce9ca6f89ce0dbb095133f0233cf9ca20f33d7a"; reference:url,publicmosaic.com/indicators; sid:9101970; rev:2;)
alert tls $HOME_NET any -> 152.42.214.0 4443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"c08168d8d128202ea9f29334d416020fdc409969898928e3d1ea249fd7ef2935"; reference:url,publicmosaic.com/indicators; sid:9101969; rev:2;)
alert tcp $HOME_NET any -> 157.230.80.211 8080 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9103310; rev:2;)
alert tcp $HOME_NET any -> 157.230.114.167 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9101701; rev:2;)
alert tls $HOME_NET any -> 157.230.125.59 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"fa909f0fc85d2138813d9c0599c4c7431de68cc89e7d7535132223d29e6956bc"; reference:url,publicmosaic.com/indicators; sid:9102046; rev:2;)
alert tls $HOME_NET any -> 157.230.253.244 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"55c7b1e2f0bb95fba6084d797725661cac4c9128870b2f4da2b60f93221dc2e3"; reference:url,publicmosaic.com/indicators; sid:9105192; rev:2;)
alert tls $HOME_NET any -> 157.245.14.84 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"dd75e5acd8fff52d99dbf0f6dc00c1b8b13e115d74b9f992d29f2957690ecff5"; reference:url,publicmosaic.com/indicators; sid:9100711; rev:2;)
alert tls $HOME_NET any -> 157.245.14.84 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"b149e5caeff1f2bad26b8d2d0d4731960257012baf3cf5729789a9839873f82b"; reference:url,publicmosaic.com/indicators; sid:9100326; rev:2;)
alert tcp $HOME_NET any -> 157.245.246.46 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9101682; rev:2;)
alert tls $HOME_NET any -> 159.65.22.41 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"83d0a7c9e45820a9cfe5609f7082ab913407efa3688adcc5632f8494872350c6"; reference:url,publicmosaic.com/indicators; sid:9100324; rev:2;)
alert tcp $HOME_NET any -> 159.65.100.153 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9103862; rev:2;)
alert tls $HOME_NET any -> 159.65.113.187 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"8c5d4b00f726f466a88b579de0d2a1864a1353384a9eb3994ec32f6d790467b4"; reference:url,publicmosaic.com/indicators; sid:9100708; rev:2;)
alert tls $HOME_NET any -> 159.65.113.187 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"8c9d1e1eecbf750293e664021853be2d47b242c2aa29c16902f015cdf50bae04"; reference:url,publicmosaic.com/indicators; sid:9100315; rev:2;)
alert tls $HOME_NET any -> 159.65.209.64 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"83d0a7c9e45820a9cfe5609f7082ab913407efa3688adcc5632f8494872350c6"; reference:url,publicmosaic.com/indicators; sid:9100323; rev:2;)
alert tls $HOME_NET any -> 159.65.231.200 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"7ed20a39bb74dad5b91e28d1487034b11c3c1e7bcb4c6b4db203cdefb8ef9d5e"; reference:url,publicmosaic.com/indicators; sid:9100318; rev:2;)
alert tls $HOME_NET any -> 159.89.192.91 8080 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"612c0dd896261c396ce44d31dec8f53178ff3cbb119591b11dcdfd3eac9e6605"; reference:url,publicmosaic.com/indicators; sid:9104225; rev:2;)
alert tls $HOME_NET any -> 159.89.232.174 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"88ee80f9db6301bce9b389d52b7e3f5939e0d228e0b599bfaa8111156ac42988"; reference:url,publicmosaic.com/indicators; sid:9100321; rev:2;)
alert tls $HOME_NET any -> 159.203.148.17 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"7af552d55bf091ac26fc98a9d85a6fec926dfb3167de39bab6adbf5185e84b44"; reference:url,publicmosaic.com/indicators; sid:9100314; rev:2;)
alert tls $HOME_NET any -> 159.223.5.148 4782 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"bb8967b9b20cafd334b56b74a20c76ea760b10f15b4ea60743bfeca1e72098a7"; reference:url,publicmosaic.com/indicators; sid:9101657; rev:2;)
alert tls $HOME_NET any -> 159.223.138.182 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"628b696f74547c632b4e941895095ea5afa396e4b7842e58ef5c1e1677567f84"; reference:url,publicmosaic.com/indicators; sid:9101966; rev:2;)
alert tls $HOME_NET any -> 159.223.145.166 443 (msg:"HOLLOWPOINT C2 poshc2"; tls.cert_fingerprint; content:"eb86685564408ce5cccaca9c159b60a899add2417da0c50b20d4a4eeb52e61eb"; reference:url,publicmosaic.com/indicators; sid:9104517; rev:2;)
alert tls $HOME_NET any -> 161.35.124.206 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"fbd2953d419ae388a89a4ef48ae01dbdb382f2360383b94bc4f0fc76eec34db1"; reference:url,publicmosaic.com/indicators; sid:9102045; rev:2;)
alert tls $HOME_NET any -> 161.35.176.231 443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"b1932d33e37714b4c4324e14dfda74c748dfd8d2ff7fe0fbf66dfa3f0f970d10"; reference:url,publicmosaic.com/indicators; sid:9100570; rev:2;)
alert tls $HOME_NET any -> 161.35.239.147 443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"a2321717f2062d34b83832b83c3c29cdf370edfa6a40b6ddfd57491b586d6ad4"; reference:url,publicmosaic.com/indicators; sid:9100572; rev:2;)
alert tls $HOME_NET any -> 161.35.239.147 40056 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"863fed66ddcf7293d547ee6017c85c54e531c0dd3ac5a59ce96e9f4f5be3b266"; reference:url,publicmosaic.com/indicators; sid:9105679; rev:2;)
alert tls $HOME_NET any -> 162.243.160.70 8443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"cd78457626be98c8a75fe00a9d5aeabacc432cebbb5b52938cdfabf9aca6514f"; reference:url,publicmosaic.com/indicators; sid:9101333; rev:2;)
alert tls $HOME_NET any -> 162.243.172.161 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"d280fa2c3f22958372e76968f20e438d83fbea4db701c21aad5851cc59b75321"; reference:url,publicmosaic.com/indicators; sid:9103837; rev:2;)
alert tls $HOME_NET any -> 164.90.149.44 80 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"251ea40b3ccfba6921f6b2ad5881deb50aa5133aa54d343d6852ac921e5682eb"; reference:url,publicmosaic.com/indicators; sid:9103681; rev:2;)
alert tls $HOME_NET any -> 164.90.149.44 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"9facf4cb0f60860863e8767e83331f830e6182a983f79b756f0b857af1f140f1"; reference:url,publicmosaic.com/indicators; sid:9100707; rev:2;)
alert tls $HOME_NET any -> 164.90.149.44 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"251ea40b3ccfba6921f6b2ad5881deb50aa5133aa54d343d6852ac921e5682eb"; reference:url,publicmosaic.com/indicators; sid:9100311; rev:2;)
alert tls $HOME_NET any -> 164.90.158.199 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"fe4a0ff21e4975e98d007069fcc729688af66d0a2c3a7cafd480731c45a07bcd"; reference:url,publicmosaic.com/indicators; sid:9100525; rev:2;)
alert tls $HOME_NET any -> 164.90.197.183 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"334c532e082eea2b88804afe246c512bee1b873ad9277edc1c91841eef7542ef"; reference:url,publicmosaic.com/indicators; sid:9100313; rev:2;)
alert tls $HOME_NET any -> 164.90.201.1 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"1bbf707f6664764bb8ade66097afd9ab433ae5b976e7b9e5bc930c2a98b0072a"; reference:url,publicmosaic.com/indicators; sid:9101965; rev:2;)
alert tls $HOME_NET any -> 164.90.205.13 8080 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"5b12cc346e4d17e93dee3bb02f1a0f783cc063618232070c5638b7d8f78fb01f"; reference:url,publicmosaic.com/indicators; sid:9101255; rev:2;)
alert tls $HOME_NET any -> 164.92.79.49 443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"990b474bcd6acb29d89ebc84735234752dfd9c4eda14fce659afdf02177b7ed0"; reference:url,publicmosaic.com/indicators; sid:9100565; rev:2;)
alert tls $HOME_NET any -> 164.92.136.111 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"5697d7421a2d7e49a72e6dd0355f4c0fbeeebff460a55894ed83835dbabbfb21"; reference:url,publicmosaic.com/indicators; sid:9100310; rev:2;)
alert tcp $HOME_NET any -> 164.92.148.104 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9101591; rev:2;)
alert tcp $HOME_NET any -> 164.92.253.168 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9101617; rev:2;)
alert tls $HOME_NET any -> 165.22.111.25 2087 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"5970ea73193c28a338c7d0ad07f8e8b14824c038dc4a95234f0aaf20a0241949"; reference:url,publicmosaic.com/indicators; sid:9102042; rev:2;)
alert tls $HOME_NET any -> 165.22.129.73 65000 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"35a069e5da46b9bd5a0e1c08157716af99680be7e32bbcbc6939d520c083b57d"; reference:url,publicmosaic.com/indicators; sid:9100544; rev:2;)
alert tls $HOME_NET any -> 165.227.32.223 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"282ea53dccb2016cf0c0bd7675942bbf4b20e9601852b7ecab929d1a9b67cfd8"; reference:url,publicmosaic.com/indicators; sid:9101581; rev:2;)
alert tls $HOME_NET any -> 165.227.87.199 443 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"19c4ecab951fcc5a1e477e4ad9e5623291d2e21e402b3503037e66ae84cd9343"; reference:url,publicmosaic.com/indicators; sid:9103989; rev:2;)
alert tls $HOME_NET any -> 165.227.231.125 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"5764cc69595087f291389848b478a4c77066a82b2a5c37fc1fcecf51b7887ab6"; reference:url,publicmosaic.com/indicators; sid:9100706; rev:2;)
alert tls $HOME_NET any -> 165.227.231.125 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"010271d003e3abf7f3c813b7d4311a4df7c663740232cf71caf394f107e90833"; reference:url,publicmosaic.com/indicators; sid:9100312; rev:2;)
alert tcp $HOME_NET any -> 165.232.140.50 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9101593; rev:2;)
alert tcp $HOME_NET any -> 165.245.181.236 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9101594; rev:2;)
alert tls $HOME_NET any -> 167.71.13.103 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"5eeb3cffe5dfe3b4f601162436a1d66c32ac59d62527907a99bc89c39a53259f"; reference:url,publicmosaic.com/indicators; sid:9100705; rev:2;)
alert tls $HOME_NET any -> 167.71.13.103 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"ee26ee73c6e27103874a3f00efd31a7721277c728c1503513464c92342764ba0"; reference:url,publicmosaic.com/indicators; sid:9100309; rev:2;)
alert tls $HOME_NET any -> 167.71.16.171 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"be98bef1ee649c4129f4f63379fba9354c6e0064b0234ef45e9fcfc5c2563fb2"; reference:url,publicmosaic.com/indicators; sid:9100308; rev:2;)
alert tcp $HOME_NET any -> 167.71.93.66 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9103863; rev:2;)
alert tcp $HOME_NET any -> 167.71.138.56 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9101683; rev:2;)
alert tls $HOME_NET any -> 167.71.184.214 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"ba914cf051841d520cdf52d5222ac58b6c6daa2ff375b3de1d8f416164017039"; reference:url,publicmosaic.com/indicators; sid:9100301; rev:2;)
alert tcp $HOME_NET any -> 167.71.203.78 47363 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102699; rev:2;)
alert tcp $HOME_NET any -> 167.71.215.243 80 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103885; rev:2;)
alert tls $HOME_NET any -> 167.71.242.108 443 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"67a37dc64686fa7ab3816951b7b02ec91c39afc46cf0cb89501ef070957bd57b"; reference:url,publicmosaic.com/indicators; sid:9101034; rev:2;)
alert tls $HOME_NET any -> 167.99.5.39 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"ce845333d39c1187778b5873cc6c5bfd17ca206a1f0c1efd1a1fcc147796f6e8"; reference:url,publicmosaic.com/indicators; sid:9100704; rev:2;)
alert tls $HOME_NET any -> 167.99.5.39 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"0ce0b1b6802054a3916f782eb2f1529b8115e3181872349752f06b28231f4bd6"; reference:url,publicmosaic.com/indicators; sid:9100098; rev:2;)
alert tls $HOME_NET any -> 167.99.51.2 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"f7adc0c1f00b0a6c3476fab1c46212e34ee9ac16a3989f0f1c276a0424a6a83f"; reference:url,publicmosaic.com/indicators; sid:9100307; rev:2;)
alert tcp $HOME_NET any -> 167.99.139.231 8004 (msg:"HOLLOWPOINT C2 pyramid_c2"; reference:url,publicmosaic.com/indicators; sid:9100268; rev:2;)
alert tls $HOME_NET any -> 167.172.142.69 443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"561263fe6c1059e3231a46eb234b8aa7aceef27ee5097e7f6289d80ce38fd843"; reference:url,publicmosaic.com/indicators; sid:9106189; rev:2;)
alert tls $HOME_NET any -> 167.172.239.135 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"13c4a32f5bcb144ef91c414769726110daa3c719ba71a6f6924c8c1354e5241b"; reference:url,publicmosaic.com/indicators; sid:9100306; rev:2;)
alert tls $HOME_NET any -> 168.144.89.48 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"4e92c1942c3c09c5e2d7f99ed4ce454665c5f7d437789688632f26dad02c1680"; reference:url,publicmosaic.com/indicators; sid:9100602; rev:2;)
alert tls $HOME_NET any -> 168.144.89.48 8443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"4e92c1942c3c09c5e2d7f99ed4ce454665c5f7d437789688632f26dad02c1680"; reference:url,publicmosaic.com/indicators; sid:9100454; rev:2;)
alert tls $HOME_NET any -> 168.144.101.98 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"83d07bed6173e8bb5a3f42d8a80ac9d3e92872e7eec47ec8993d1cd7cb5b874e"; reference:url,publicmosaic.com/indicators; sid:9100431; rev:2;)
alert tcp $HOME_NET any -> 170.64.138.247 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9103617; rev:2;)
alert tls $HOME_NET any -> 170.64.162.117 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"5287364e4dcafdca62d2fa4c2e6a3831c17d65502c0b30e29ab81c77f3baf5a0"; reference:url,publicmosaic.com/indicators; sid:9101307; rev:2;)
alert tls $HOME_NET any -> 170.64.177.194 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"92be9d384496c0bfad762e89d81317a658d6af4aa1817d597d4bc1a0f9b85d16"; reference:url,publicmosaic.com/indicators; sid:9100303; rev:2;)
alert tcp $HOME_NET any -> 170.64.178.133 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9101595; rev:2;)
alert tls $HOME_NET any -> 170.64.183.242 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"b48aa4806fa60c888d1c3115216862b89ff0f9aba2f01b9b324f8409d3444463"; reference:url,publicmosaic.com/indicators; sid:9106123; rev:2;)
alert tls $HOME_NET any -> 170.64.229.96 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"25b8cf1e97940f47718afc7652c5bc6d6cd14133bb4278aecf70375f127930f4"; reference:url,publicmosaic.com/indicators; sid:9102040; rev:2;)
alert tls $HOME_NET any -> 170.64.254.183 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"92be9d384496c0bfad762e89d81317a658d6af4aa1817d597d4bc1a0f9b85d16"; reference:url,publicmosaic.com/indicators; sid:9100302; rev:2;)
alert tls $HOME_NET any -> 174.138.9.149 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"4d6c37c29cd7e8496cf8c034aae7779bdc0135b2856d320ef0b367fd03afe6f4"; reference:url,publicmosaic.com/indicators; sid:9100523; rev:2;)
alert tls $HOME_NET any -> 174.138.86.141 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"f7538fa230cd3bba6da1ca7e71006845b251cea465957c5edfcff752e79f3c83"; reference:url,publicmosaic.com/indicators; sid:9100522; rev:2;)
alert tls $HOME_NET any -> 178.62.74.147 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"31acf84cff5f9756862a943dbbe7a7243b2429283810fc8bd8c30049bd4fbe91"; reference:url,publicmosaic.com/indicators; sid:9105857; rev:2;)
alert tls $HOME_NET any -> 178.128.14.67 4443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"9230c9fa48d68de48c55faccdf1d5547c3794752e5b2965406dd4e8cc139f884"; reference:url,publicmosaic.com/indicators; sid:9104487; rev:2;)
alert tcp $HOME_NET any -> 178.128.18.57 3028 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102688; rev:2;)
alert tcp $HOME_NET any -> 178.128.18.57 7777 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102687; rev:2;)
alert tls $HOME_NET any -> 178.128.21.54 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"25f70c6d4330f59e04e07c1d2614e9d0e4ed4a8a778d2215f4019c0fe837228c"; reference:url,publicmosaic.com/indicators; sid:9101963; rev:2;)
alert tls $HOME_NET any -> 178.128.21.54 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"b5eb6af96497bd333a02922a8b5afde55029aef5ead7edb672b14678c58452fc"; reference:url,publicmosaic.com/indicators; sid:9100299; rev:2;)
alert tls $HOME_NET any -> 178.128.63.20 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"f4707cc1a8dbdd5ace10eb65cee3642540f1a27e7322b30f1749753bed4624da"; reference:url,publicmosaic.com/indicators; sid:9100298; rev:2;)
alert tls $HOME_NET any -> 178.128.140.47 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"334c532e082eea2b88804afe246c512bee1b873ad9277edc1c91841eef7542ef"; reference:url,publicmosaic.com/indicators; sid:9100746; rev:2;)
alert tls $HOME_NET any -> 178.128.222.137 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"36ca57038359b888ea99744016d157a526f6944b202a645c134ac152f5d3783b"; reference:url,publicmosaic.com/indicators; sid:9100430; rev:2;)
alert tls $HOME_NET any -> 178.128.244.152 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"87a2f2ded1bc4f84ffc5607423f1dac6cec01c77cac87f6cf72c8c1b44fd5258"; reference:url,publicmosaic.com/indicators; sid:9100296; rev:2;)
alert tls $HOME_NET any -> 188.166.40.236 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"2bb88c3b2b0006268acff8d3cb333dc773505aba63bb610ed61acbf3c2a52011"; reference:url,publicmosaic.com/indicators; sid:9100521; rev:2;)
alert tcp $HOME_NET any -> 188.166.213.130 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9101619; rev:2;)
alert tls $HOME_NET any -> 188.166.244.201 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"7942e59619f61bcd32072eb52dfbf99aa402c1c2b89d4e6c5512b5696d55e657"; reference:url,publicmosaic.com/indicators; sid:9100596; rev:2;)
alert tls $HOME_NET any -> 188.166.244.201 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"92a899eb87b7ad255c934ab518e9d587c779460d677ecf215c232ae70e6781c1"; reference:url,publicmosaic.com/indicators; sid:9100448; rev:2;)
alert tls $HOME_NET any -> 198.199.72.177 7771 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"e10fb7c4f468cdcb4de1e00e4ff150f151c3a7bfea6c62109dd2c84816f990b2"; reference:url,publicmosaic.com/indicators; sid:9100223; rev:2;)
alert tls $HOME_NET any -> 198.199.72.177 9900 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"ea78db19c584fef1610bd5da7007da6487118d4e196d5eef62673c42b13a2f9e"; reference:url,publicmosaic.com/indicators; sid:9100269; rev:2;)
alert tls $HOME_NET any -> 198.199.86.166 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"ec0c6c21d73dbe28898f12835db504fcfdf83a04f5a3adc38ed7f260750d2222"; reference:url,publicmosaic.com/indicators; sid:9103333; rev:2;)
alert tcp $HOME_NET any -> 204.48.25.60 4449 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9104082; rev:2;)
alert tls $HOME_NET any -> 206.81.21.156 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"e1d16aca4c140a79f18f272d7800a7151c68162295075a626820b86bf553772c"; reference:url,publicmosaic.com/indicators; sid:9100595; rev:2;)
alert tls $HOME_NET any -> 206.81.21.156 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"de1f95f7dfddbeb19b7c3a2fcec4169f53fc83d7e899217bc8465b7a2b7d0d8c"; reference:url,publicmosaic.com/indicators; sid:9100441; rev:2;)
alert tls $HOME_NET any -> 206.81.21.156 40056 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"3d56aadb7101660dd84db7627acc4e908046f6f9514ea0a630deedb1cc0545db"; reference:url,publicmosaic.com/indicators; sid:9100743; rev:2;)
alert tcp $HOME_NET any -> 206.189.141.228 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9101621; rev:2;)
alert tcp $HOME_NET any -> 206.189.252.227 80 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9104191; rev:2;)