# hollowpoint.rules — generated 2026-09-15 10:08 UTC — 20 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: asn 14618 — https://publicmosaic.com/asn/14618
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 0
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tcp $HOME_NET any -> 3.86.241.241 80 (msg:"HOLLOWPOINT C2 adaptix"; reference:url,publicmosaic.com/indicators; sid:9100686; rev:2;)
alert tcp $HOME_NET any -> 3.209.60.1 443 (msg:"HOLLOWPOINT C2 adaptix"; reference:url,publicmosaic.com/indicators; sid:9100679; rev:2;)
alert tls $HOME_NET any -> 3.222.180.89 8443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"db4857641e188b68a7203cac17643603592ac7f6280934e1221e5b8fa73e0185"; reference:url,publicmosaic.com/indicators; sid:9103409; rev:2;)
alert tls $HOME_NET any -> 13.220.213.63 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"d5d09055cd8028006a37424050b137eec1124d187ab82635ba71dd40ce86a452"; reference:url,publicmosaic.com/indicators; sid:9101462; rev:2;)
alert tls $HOME_NET any -> 18.97.21.97 40056 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"31aeea6f8aebf50060f3c88be6a5db22048624cf61306b58e0a184402729d1b3"; reference:url,publicmosaic.com/indicators; sid:9104221; rev:2;)
alert tls $HOME_NET any -> 18.97.21.97 57043 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"2ebfe6001235c77f2c59b0774ad241d8073d4359ceb43323c76c2183cf0307f5"; reference:url,publicmosaic.com/indicators; sid:9103350; rev:2;)
alert tls $HOME_NET any -> 18.97.21.97 57143 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"cad765038b0c7f7d02f65ac91600e61bebd301f927372ba870993f0ba97e9195"; reference:url,publicmosaic.com/indicators; sid:9103349; rev:2;)
alert tls $HOME_NET any -> 44.200.237.10 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"3da223e09c2308ab1c8d431d2b01f9e0ecf998676ef1d7e24f59503610915222"; reference:url,publicmosaic.com/indicators; sid:9101922; rev:2;)
alert tls $HOME_NET any -> 44.217.217.119 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"ab6cc0d0662d6fd8def2b2ffb96e63d653a78d0fd60baf39477235852ce5590f"; reference:url,publicmosaic.com/indicators; sid:9101748; rev:2;)
alert tls $HOME_NET any -> 52.4.177.142 8443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"48bf0f3c036d65d7a1627e564ac06c2ef18f20baafc7ded3d34a512fabc25a96"; reference:url,publicmosaic.com/indicators; sid:9103404; rev:2;)
alert tls $HOME_NET any -> 52.22.15.69 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"fb9ee97dc8dff1c25d9b238f6fbd5e5d2e569c1a77637fa02d1e6d9e8c3012dd"; reference:url,publicmosaic.com/indicators; sid:9100782; rev:2;)
alert tls $HOME_NET any -> 52.87.32.4 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9103403; rev:2;)
alert tls $HOME_NET any -> 52.87.32.4 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"2b1338db59e29d09d25f02426db4d0821411c7ed4e5003595e5e8aa1f3d2a97c"; reference:url,publicmosaic.com/indicators; sid:9103402; rev:2;)
alert tls $HOME_NET any -> 54.145.56.188 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"53c64405646bc3d7070ed0456eec4e8721cafd8cc3338505cf1fe9d0a1a7fba8"; reference:url,publicmosaic.com/indicators; sid:9103777; rev:2;)
alert tls $HOME_NET any -> 54.158.87.112 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100217; rev:2;)
alert tls $HOME_NET any -> 54.165.230.182 7443 (msg:"HOLLOWPOINT C2 covenant"; tls.cert_fingerprint; content:"d67f9e12ad7c356565c70818584be849e0a4981a5b895a3750001c9781fa0be9"; reference:url,publicmosaic.com/indicators; sid:9103304; rev:2;)
alert tls $HOME_NET any -> 54.173.174.159 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"f76377c291a730fdbc1d853058d2cdbf274a95cf6478f580e861ab7551a413b7"; reference:url,publicmosaic.com/indicators; sid:9106644; rev:2;)
alert tls $HOME_NET any -> 98.84.133.235 443 (msg:"HOLLOWPOINT C2 metasploit_meterpreter"; tls.cert_fingerprint; content:"43202ae839cfb25ff9e6a247be69b173b3019f02a161e030d44f552aa6b19f70"; reference:url,publicmosaic.com/indicators; sid:9103933; rev:2;)
alert tls $HOME_NET any -> 100.53.240.26 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"301e153d4af4744823e6475eaf79065b17044b8a8ca93a56a24b662582141c56"; reference:url,publicmosaic.com/indicators; sid:9104252; rev:2;)
alert tls $HOME_NET any -> 107.23.60.48 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"4ea7f45313aa7ca5ef231cf78a1451e9dcf3ef0717795169f4c94b6b6b7e5b27"; reference:url,publicmosaic.com/indicators; sid:9101944; rev:2;)