# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 13 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: asn 14956 — https://publicmosaic.com/asn/14956
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 0
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tcp $HOME_NET any -> 45.59.120.82 7001 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9101678; rev:2;)
alert tls $HOME_NET any -> 104.194.135.115 56001 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"504b180277955776580add51d2a6d5cddeaedb5672c2c508f246c0fc2c5ebea3"; reference:url,publicmosaic.com/indicators; sid:9105107; rev:2;)
alert tls $HOME_NET any -> 104.194.135.149 56001 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"504b180277955776580add51d2a6d5cddeaedb5672c2c508f246c0fc2c5ebea3"; reference:url,publicmosaic.com/indicators; sid:9105106; rev:2;)
alert tls $HOME_NET any -> 104.194.135.211 56001 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"504b180277955776580add51d2a6d5cddeaedb5672c2c508f246c0fc2c5ebea3"; reference:url,publicmosaic.com/indicators; sid:9105105; rev:2;)
alert tls $HOME_NET any -> 144.172.65.54 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"df12fde46b32ba28370960da9ca5eb4e19e0464ea413a61f8942cfbffde5bdca"; reference:url,publicmosaic.com/indicators; sid:9106563; rev:2;)
alert tls $HOME_NET any -> 144.172.112.126 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"5124da47575f119eb08488e54f896960a7662e89329d61df30b5b4fbfd3e2a18"; reference:url,publicmosaic.com/indicators; sid:9105814; rev:2;)
alert tls $HOME_NET any -> 144.172.118.114 51956 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"0a16c2485b61a2cbd3ca1d65bb881a6a5dbbc63a969736754c70c39fc9d0e925"; reference:url,publicmosaic.com/indicators; sid:9106203; rev:2;)
alert tls $HOME_NET any -> 153.75.82.143 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"ec02bd371b0c9807ab7eb75aa9c0afb4859195f863fa0c50e6d00f99cbbe5ec8"; reference:url,publicmosaic.com/indicators; sid:9100759; rev:2;)
alert tls $HOME_NET any -> 153.75.82.143 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"faadc7aeb1fd4430bbc773c5e73b4cd121ac7036378f7e7f584af474cd44a579"; reference:url,publicmosaic.com/indicators; sid:9100105; rev:2;)
alert tls $HOME_NET any -> 172.86.80.201 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"79ac03d4166023fc5e6ac436f005e693a693fb93cc7fd3b26467d18756162496"; reference:url,publicmosaic.com/indicators; sid:9103994; rev:2;)
alert tls $HOME_NET any -> 172.86.119.186 443 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"bc1841eafd44abd2a6ab70491fed35e5d1958921c51ea968772484e421ff39b5"; reference:url,publicmosaic.com/indicators; sid:9101313; rev:2;)
alert tls $HOME_NET any -> 172.86.122.177 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"92653bf7b73322a4c4805f601adc31fae9c37d2fe9330606ede41d3516c5506b"; reference:url,publicmosaic.com/indicators; sid:9101329; rev:2;)
alert tls $HOME_NET any -> 198.251.91.17 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"f971c123faa94a5cfebe71b6d3b8be455b802fbe7d6d90b0c5e8f5fe7f1092b0"; reference:url,publicmosaic.com/indicators; sid:9106743; rev:2;)