# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 109 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: asn 152194 — https://publicmosaic.com/asn/152194
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 2
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tls $HOME_NET any -> 27.124.17.151 8801 (msg:"HOLLOWPOINT C2 dcrat"; tls.cert_fingerprint; content:"fa1b61fde12b8ea2541a45625d32a0a4fd0c0392935a3822b0906f8e56f91384"; reference:url,publicmosaic.com/indicators; sid:9100059; rev:2;)
alert tls $HOME_NET any -> 27.124.17.164 8801 (msg:"HOLLOWPOINT C2 dcrat"; tls.cert_fingerprint; content:"fa1b61fde12b8ea2541a45625d32a0a4fd0c0392935a3822b0906f8e56f91384"; reference:url,publicmosaic.com/indicators; sid:9100057; rev:2;)
alert tls $HOME_NET any -> 27.124.17.173 8801 (msg:"HOLLOWPOINT C2 dcrat"; tls.cert_fingerprint; content:"fa1b61fde12b8ea2541a45625d32a0a4fd0c0392935a3822b0906f8e56f91384"; reference:url,publicmosaic.com/indicators; sid:9100058; rev:2;)
alert tcp $HOME_NET any -> 27.124.18.3 9988 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103205; rev:2;)
alert tcp $HOME_NET any -> 27.124.18.3 9999 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101018; rev:2;)
alert tcp $HOME_NET any -> 27.124.18.6 9988 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103204; rev:2;)
alert tcp $HOME_NET any -> 27.124.18.6 9999 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101019; rev:2;)
alert tcp $HOME_NET any -> 27.124.18.7 9988 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103203; rev:2;)
alert tcp $HOME_NET any -> 27.124.18.7 9999 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101017; rev:2;)
alert tls $HOME_NET any -> 27.124.36.136 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"0e70b610e05a47723602104c3315f513798f2d84e165c96ddc383d8bf665651d"; reference:url,publicmosaic.com/indicators; sid:9101559; rev:2;)
alert tls $HOME_NET any -> 27.124.36.151 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"0e70b610e05a47723602104c3315f513798f2d84e165c96ddc383d8bf665651d"; reference:url,publicmosaic.com/indicators; sid:9101551; rev:2;)
alert tls $HOME_NET any -> 27.124.43.141 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"d6e857ac9aa19f32c8a32c2071519adc6c108f930b70e11f9abe13f6b99ea8a7"; reference:url,publicmosaic.com/indicators; sid:9101845; rev:2;)
alert tls $HOME_NET any -> 27.124.43.145 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"d6e857ac9aa19f32c8a32c2071519adc6c108f930b70e11f9abe13f6b99ea8a7"; reference:url,publicmosaic.com/indicators; sid:9101848; rev:2;)
alert tls $HOME_NET any -> 27.124.43.241 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"d6e857ac9aa19f32c8a32c2071519adc6c108f930b70e11f9abe13f6b99ea8a7"; reference:url,publicmosaic.com/indicators; sid:9101844; rev:2;)
alert tls $HOME_NET any -> 43.243.73.187 24871 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c376478"; reference:url,publicmosaic.com/indicators; sid:9103376; rev:2;)
alert tls $HOME_NET any -> 45.64.52.67 8888 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"302e4a3aae0b72450430a1f7340003dc2156ccd8ead9ddf07e5f2d96dd379cfd"; reference:url,publicmosaic.com/indicators; sid:9105346; rev:2;)
alert tls $HOME_NET any -> 45.64.52.67 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"d6b7f8f1f1a67cd98ab456376a68104d35b50f8dd1416ac2782fa17497d3e8c0"; reference:url,publicmosaic.com/indicators; sid:9104119; rev:2;)
alert tcp $HOME_NET any -> 45.64.52.70 4040 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9103672; rev:2;)
alert tcp $HOME_NET any -> 45.64.52.82 4040 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9103647; rev:2;)
alert tls $HOME_NET any -> 103.12.148.37 24871 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c376478"; reference:url,publicmosaic.com/indicators; sid:9103401; rev:2;)
alert tcp $HOME_NET any -> 103.45.66.107 7878 (msg:"HOLLOWPOINT malware distribution host venomrat"; reference:url,publicmosaic.com/indicators; sid:9101859; rev:2;)
alert tcp $HOME_NET any -> 112.213.103.111 8888 (msg:"HOLLOWPOINT C2 darksword"; reference:url,publicmosaic.com/indicators; sid:9105963; rev:2;)
alert tcp $HOME_NET any -> 118.107.1.203 7878 (msg:"HOLLOWPOINT C2 quasar_family"; reference:url,publicmosaic.com/indicators; sid:9101858; rev:2;)
alert tls $HOME_NET any -> 118.107.9.178 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"2c6a2dad17543b145e8dae3cf9128c5112467520776b36aa02cedbcd33e46c4f"; reference:url,publicmosaic.com/indicators; sid:9101742; rev:2;)
alert tls $HOME_NET any -> 118.107.9.213 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"2c6a2dad17543b145e8dae3cf9128c5112467520776b36aa02cedbcd33e46c4f"; reference:url,publicmosaic.com/indicators; sid:9104117; rev:2;)
alert tls $HOME_NET any -> 118.107.9.217 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"2c6a2dad17543b145e8dae3cf9128c5112467520776b36aa02cedbcd33e46c4f"; reference:url,publicmosaic.com/indicators; sid:9103838; rev:2;)
alert tls $HOME_NET any -> 118.107.9.233 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"2c6a2dad17543b145e8dae3cf9128c5112467520776b36aa02cedbcd33e46c4f"; reference:url,publicmosaic.com/indicators; sid:9104116; rev:2;)
alert tcp $HOME_NET any -> 118.107.16.32 7878 (msg:"HOLLOWPOINT C2 venomrat"; reference:url,publicmosaic.com/indicators; sid:9101857; rev:2;)
alert tcp $HOME_NET any -> 118.107.16.32 56002 (msg:"HOLLOWPOINT C2 pure_rat"; reference:url,publicmosaic.com/indicators; sid:9106473; rev:2;)
alert tcp $HOME_NET any -> 118.107.16.32 56003 (msg:"HOLLOWPOINT C2 pure_rat"; reference:url,publicmosaic.com/indicators; sid:9106472; rev:2;)
alert tcp $HOME_NET any -> 118.107.23.26 80 (msg:"HOLLOWPOINT C2 flying_eagle"; reference:url,publicmosaic.com/indicators; sid:9101806; rev:2;)
alert tls $HOME_NET any -> 118.107.23.32 8693 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"02362a00810650c93b9d845bc237fc929e5e5d9154b7e37bbfa4c3aecb140e00"; reference:url,publicmosaic.com/indicators; sid:9102258; rev:2;)
alert tls $HOME_NET any -> 118.107.44.140 2096 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"266bb301d68f378fdee90ee79ecff4d3aca2c5ca97b98ca1b508b59a744d7fb7"; reference:url,publicmosaic.com/indicators; sid:9102288; rev:2;)
alert tls $HOME_NET any -> 118.107.44.149 2096 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"266bb301d68f378fdee90ee79ecff4d3aca2c5ca97b98ca1b508b59a744d7fb7"; reference:url,publicmosaic.com/indicators; sid:9102287; rev:2;)
alert tls $HOME_NET any -> 118.107.44.162 2096 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"266bb301d68f378fdee90ee79ecff4d3aca2c5ca97b98ca1b508b59a744d7fb7"; reference:url,publicmosaic.com/indicators; sid:9102286; rev:2;)
alert tls $HOME_NET any -> 118.107.47.27 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"645a14f0c8333f5b0eb0bf2de85ecffc9801cb1ffa7f19beff727de192a943d4"; reference:url,publicmosaic.com/indicators; sid:9105805; rev:2;)
alert tls $HOME_NET any -> 118.107.47.28 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"645a14f0c8333f5b0eb0bf2de85ecffc9801cb1ffa7f19beff727de192a943d4"; reference:url,publicmosaic.com/indicators; sid:9105804; rev:2;)
alert tcp $HOME_NET any -> 121.127.232.151 8080 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102429; rev:2;)
alert tls $HOME_NET any -> 121.127.253.146 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"643ac62b3a1f4adca9cad24d1e353e2b642e4f3d14dde9fd5b70fdd2bf0bf052"; reference:url,publicmosaic.com/indicators; sid:9100427; rev:2;)
alert tcp $HOME_NET any -> 121.127.253.146 4444 (msg:"HOLLOWPOINT C2 adaptix"; reference:url,publicmosaic.com/indicators; sid:9100652; rev:2;)
alert tls $HOME_NET any -> 134.122.132.3 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"c54c146b0398c44850a252d29899caf566d5c67f6a2701b945620edbd6ca89fe"; reference:url,publicmosaic.com/indicators; sid:9100464; rev:2;)
alert tls $HOME_NET any -> 134.122.132.28 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"c54c146b0398c44850a252d29899caf566d5c67f6a2701b945620edbd6ca89fe"; reference:url,publicmosaic.com/indicators; sid:9100458; rev:2;)
alert tls $HOME_NET any -> 134.122.132.35 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"c54c146b0398c44850a252d29899caf566d5c67f6a2701b945620edbd6ca89fe"; reference:url,publicmosaic.com/indicators; sid:9100460; rev:2;)
alert tcp $HOME_NET any -> 134.122.153.121 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102391; rev:2;)
alert tls $HOME_NET any -> 134.122.153.121 443 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"16c0033299d245fcc6ad9472c00d6450c495b31b326bc32471fecb321b7fc8ed"; reference:url,publicmosaic.com/indicators; sid:9103978; rev:2;)
alert tls $HOME_NET any -> 134.122.153.121 8080 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"253eb7154b2ebd6c89c962d87845d0b04b1f19cc93524f345e0bd3ae864cf459"; reference:url,publicmosaic.com/indicators; sid:9103977; rev:2;)
alert tcp $HOME_NET any -> 134.122.154.92 2082 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105653; rev:2;)
alert tcp $HOME_NET any -> 134.122.154.92 2086 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105650; rev:2;)
alert tcp $HOME_NET any -> 134.122.155.233 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104553; rev:2;)
alert tcp $HOME_NET any -> 134.122.155.233 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104295; rev:2;)
alert tcp $HOME_NET any -> 134.122.155.233 8085 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104294; rev:2;)
alert tcp $HOME_NET any -> 134.122.155.233 8086 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104293; rev:2;)
alert tcp $HOME_NET any -> 134.122.155.243 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104552; rev:2;)
alert tcp $HOME_NET any -> 134.122.155.243 8085 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104292; rev:2;)
alert tcp $HOME_NET any -> 134.122.155.243 8086 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104291; rev:2;)
alert tcp $HOME_NET any -> 134.122.155.245 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104551; rev:2;)
alert tcp $HOME_NET any -> 134.122.155.245 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104926; rev:2;)
alert tcp $HOME_NET any -> 134.122.155.245 8085 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104290; rev:2;)
alert tcp $HOME_NET any -> 134.122.155.245 8086 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104289; rev:2;)
alert tcp $HOME_NET any -> 134.122.168.166 8848 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9101681; rev:2;)
alert tls $HOME_NET any -> 134.122.203.247 5522 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c376478"; reference:url,publicmosaic.com/indicators; sid:9103377; rev:2;)
alert tcp $HOME_NET any -> 137.220.151.95 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9100182; rev:2;)
alert tcp $HOME_NET any -> 137.220.151.95 8888 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9100180; rev:2;)
alert tcp $HOME_NET any -> 137.220.151.95 9999 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9100181; rev:2;)
alert tls $HOME_NET any -> 137.220.194.15 23337 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9103463; rev:2;)
alert tcp $HOME_NET any -> 137.220.199.216 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102390; rev:2;)
alert tls $HOME_NET any -> 137.220.219.243 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"8d23f121b37fa17914194ad762725819f8d5a8150e91d2517dc9ae635fe15e6d"; reference:url,publicmosaic.com/indicators; sid:9101741; rev:2;)
alert tcp $HOME_NET any -> 137.220.251.124 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102389; rev:2;)
alert tls $HOME_NET any -> 143.92.32.198 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"abf64197d32d00d8d87116343843d53887d362b93330620683f5a1f8f3701681"; reference:url,publicmosaic.com/indicators; sid:9101805; rev:2;)
alert tls $HOME_NET any -> 143.92.36.171 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"711241c584fc4b66b18dc6334d61f47ca10068fe7280b4106c1df39232c480bc"; reference:url,publicmosaic.com/indicators; sid:9101799; rev:2;)
alert tls $HOME_NET any -> 143.92.36.176 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"711241c584fc4b66b18dc6334d61f47ca10068fe7280b4106c1df39232c480bc"; reference:url,publicmosaic.com/indicators; sid:9101807; rev:2;)
alert tcp $HOME_NET any -> 143.92.51.145 80 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9105651; rev:2;)
alert tcp $HOME_NET any -> 143.92.51.145 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102377; rev:2;)
alert tcp $HOME_NET any -> 143.92.51.145 18082 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102376; rev:2;)
alert tcp $HOME_NET any -> 143.92.51.145 18083 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102375; rev:2;)
alert tls $HOME_NET any -> 143.92.57.247 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"18df181867422ea6dd581969bdf5cc9563d436a79473a18c661c8ae13402a41d"; reference:url,publicmosaic.com/indicators; sid:9106572; rev:2;)
alert tls $HOME_NET any -> 143.92.60.13 443 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"86a80484a6e9f8e44d3e4f4d46f017c1aea57e1ae4a214c34bfeeabec15228e3"; reference:url,publicmosaic.com/indicators; sid:9102282; rev:2;)
alert tcp $HOME_NET any -> 143.92.60.13 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100484; rev:2;)
alert tls $HOME_NET any -> 143.92.60.24 443 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"86a80484a6e9f8e44d3e4f4d46f017c1aea57e1ae4a214c34bfeeabec15228e3"; reference:url,publicmosaic.com/indicators; sid:9104508; rev:2;)
alert tcp $HOME_NET any -> 143.92.60.24 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100881; rev:2;)
alert tls $HOME_NET any -> 143.92.60.26 443 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"86a80484a6e9f8e44d3e4f4d46f017c1aea57e1ae4a214c34bfeeabec15228e3"; reference:url,publicmosaic.com/indicators; sid:9101737; rev:2;)
alert tcp $HOME_NET any -> 143.92.60.26 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100482; rev:2;)
alert tcp $HOME_NET any -> 143.92.62.62 7777 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106410; rev:2;)
alert tcp $HOME_NET any -> 143.92.62.62 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106329; rev:2;)
alert tcp $HOME_NET any -> 192.252.176.72 2659 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9103665; rev:2;)
alert tcp $HOME_NET any -> 192.252.178.206 80 (msg:"HOLLOWPOINT C2 flying_eagle"; reference:url,publicmosaic.com/indicators; sid:9101780; rev:2;)
alert tls $HOME_NET any -> 192.252.178.206 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"dd277d53eab335690cc92ad19c9408f937b8d36eda48e167ecee2b470e4c9452"; reference:url,publicmosaic.com/indicators; sid:9101779; rev:2;)
alert tls $HOME_NET any -> 192.252.179.24 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100195; rev:2;)
alert tls $HOME_NET any -> 192.252.185.78 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100193; rev:2;)
alert tls $HOME_NET any -> 192.253.226.10 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"2623eab9853231c1de8f513309e6a31c4485815a6cb0f67fba707a1e7dc5e9ea"; reference:url,publicmosaic.com/indicators; sid:9105096; rev:2;)
alert tcp $HOME_NET any -> 202.61.130.163 8888 (msg:"HOLLOWPOINT C2 adaptix"; reference:url,publicmosaic.com/indicators; sid:9101451; rev:2;)
alert tls $HOME_NET any -> 202.61.137.217 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"5c1b750bfc6caa351911ab89412e296346e10d5d3c43d73944c70285c502efc8"; reference:url,publicmosaic.com/indicators; sid:9101959; rev:2;)
alert tcp $HOME_NET any -> 202.61.138.81 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105469; rev:2;)
alert tcp $HOME_NET any -> 202.61.140.122 58002 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103805; rev:2;)
alert tcp $HOME_NET any -> 202.61.140.244 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102642; rev:2;)
alert tls $HOME_NET any -> 202.95.8.92 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"71a3a75eab1d5aa102de250df100cd37dd67b5d01559582c92d149c07fcf2e9b"; reference:url,publicmosaic.com/indicators; sid:9100443; rev:2;)
alert tls $HOME_NET any -> 202.95.8.97 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"71a3a75eab1d5aa102de250df100cd37dd67b5d01559582c92d149c07fcf2e9b"; reference:url,publicmosaic.com/indicators; sid:9100442; rev:2;)
alert tls $HOME_NET any -> 202.95.8.98 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"71a3a75eab1d5aa102de250df100cd37dd67b5d01559582c92d149c07fcf2e9b"; reference:url,publicmosaic.com/indicators; sid:9100438; rev:2;)
alert tls $HOME_NET any -> 202.95.17.188 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"cde406af5bae8bdee4ee186f77bd3a6cf688bdc316c12cec6e256255e0b96321"; reference:url,publicmosaic.com/indicators; sid:9100439; rev:2;)
alert tcp $HOME_NET any -> 202.95.22.67 3863 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9103663; rev:2;)
alert tcp $HOME_NET any -> 202.95.22.69 3863 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9103662; rev:2;)
alert tls $HOME_NET any -> 202.95.22.205 443 (msg:"HOLLOWPOINT C2 btmob"; tls.cert_fingerprint; content:"7b698321a08974faf7d1d419cf1f1e4d0ad12e960a52f9de13e3531f72dbbb8a"; reference:url,publicmosaic.com/indicators; sid:9101538; rev:2;)
alert tcp $HOME_NET any -> 202.162.99.199 7878 (msg:"HOLLOWPOINT C2 quasar_family"; reference:url,publicmosaic.com/indicators; sid:9101856; rev:2;)
alert tcp $HOME_NET any -> 202.162.99.229 8888 (msg:"HOLLOWPOINT C2 darksword"; reference:url,publicmosaic.com/indicators; sid:9105970; rev:2;)
alert tls $HOME_NET any -> 202.162.109.5 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"18df181867422ea6dd581969bdf5cc9563d436a79473a18c661c8ae13402a41d"; reference:url,publicmosaic.com/indicators; sid:9106568; rev:2;)
alert tls $HOME_NET any -> 202.162.109.6 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"18df181867422ea6dd581969bdf5cc9563d436a79473a18c661c8ae13402a41d"; reference:url,publicmosaic.com/indicators; sid:9106567; rev:2;)
alert tcp $HOME_NET any -> 210.56.48.176 8808 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9103615; rev:2;)
alert tcp $HOME_NET any -> 210.56.48.227 80 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9100247; rev:2;)
alert tls $HOME_NET any -> 210.56.48.227 8081 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c376478"; reference:url,publicmosaic.com/indicators; sid:9100194; rev:2;)