# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 69 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: asn 16276 — https://publicmosaic.com/asn/16276
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 0
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tcp $HOME_NET any -> 15.204.14.143 80 (msg:"HOLLOWPOINT C2 havoc"; reference:url,publicmosaic.com/indicators; sid:9100582; rev:2;)
alert tcp $HOME_NET any -> 15.204.14.143 443 (msg:"HOLLOWPOINT C2 havoc"; reference:url,publicmosaic.com/indicators; sid:9100566; rev:2;)
alert tls $HOME_NET any -> 15.204.14.143 40056 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"50037c0fdb26afebef03491c5fbd827dc9544772c85f817b235b2882f48eacbb"; reference:url,publicmosaic.com/indicators; sid:9104159; rev:2;)
alert tls $HOME_NET any -> 15.204.66.40 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"d0578ddc0dcfae2ed5471918784563f8e88ff811de72cce9ff082a299a1cbed0"; reference:url,publicmosaic.com/indicators; sid:9103718; rev:2;)
alert tcp $HOME_NET any -> 15.204.95.228 80 (msg:"HOLLOWPOINT C2 havoc"; reference:url,publicmosaic.com/indicators; sid:9100573; rev:2;)
alert tcp $HOME_NET any -> 15.204.95.228 443 (msg:"HOLLOWPOINT C2 havoc"; reference:url,publicmosaic.com/indicators; sid:9100568; rev:2;)
alert tls $HOME_NET any -> 15.204.95.228 40056 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"50037c0fdb26afebef03491c5fbd827dc9544772c85f817b235b2882f48eacbb"; reference:url,publicmosaic.com/indicators; sid:9103955; rev:2;)
alert tls $HOME_NET any -> 15.204.173.19 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"707de2f2ff6627b6fc9f62bd0580ed4ab33f591ca1261b2654030b14477e1357"; reference:url,publicmosaic.com/indicators; sid:9103717; rev:2;)
alert tls $HOME_NET any -> 15.204.248.160 8443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"324b17f2061ff8de7ae11c23871997c6789f0748ec90ed3c19f6c469d9fd89a8"; reference:url,publicmosaic.com/indicators; sid:9100409; rev:2;)
alert tls $HOME_NET any -> 15.235.37.196 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"b1e7e12d8294288b4d148ad79f17018b61ff3688ff5006c719d378ae321c7acf"; reference:url,publicmosaic.com/indicators; sid:9101919; rev:2;)
alert tls $HOME_NET any -> 15.235.166.83 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"eff1a70f5ca124946a6cde82c9b9526647c64c2ac1af0df9a0fb60c7e7ff8ada"; reference:url,publicmosaic.com/indicators; sid:9103716; rev:2;)
alert tls $HOME_NET any -> 15.235.204.60 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"017342a153aecc3932b5ab1891b40846a9bd513e257a6619006ffca3f1580fa2"; reference:url,publicmosaic.com/indicators; sid:9105678; rev:2;)
alert tcp $HOME_NET any -> 37.187.222.170 80 (msg:"HOLLOWPOINT C2 nimplant"; reference:url,publicmosaic.com/indicators; sid:9100692; rev:2;)
alert tls $HOME_NET any -> 51.38.146.21 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"bc53cceff3c2c42822f0e451da8e42c6b140e5966b811e752d1d5fb037888e14"; reference:url,publicmosaic.com/indicators; sid:9100697; rev:2;)
alert tls $HOME_NET any -> 51.68.216.211 443 (msg:"HOLLOWPOINT C2 bianlian"; tls.cert_fingerprint; content:"42b809b02b4a1aae78bd7d7241698addb526fbea8ffcd39d39e488f4517349b2"; reference:url,publicmosaic.com/indicators; sid:9103884; rev:2;)
alert tls $HOME_NET any -> 51.75.62.52 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"ee99fb52abe75be69ea7ac7825e4b5765e1b037908237983111c143b2b695683"; reference:url,publicmosaic.com/indicators; sid:9100715; rev:2;)
alert tls $HOME_NET any -> 51.75.62.52 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"7dccde44307b50b16e74d4af9a849382f68de0b90fd6bb2986ce32bc01cfd427"; reference:url,publicmosaic.com/indicators; sid:9100384; rev:2;)
alert tls $HOME_NET any -> 51.79.169.74 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"183617c661031ff658c324e9695e63c48a5ac0776f607717ce4d50aef35bd102"; reference:url,publicmosaic.com/indicators; sid:9101556; rev:2;)
alert tls $HOME_NET any -> 51.81.63.109 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"899eb351331ebdcfaeac4aafb4b40a7b1e5602e57108a7f8faacb8de3fc196b9"; reference:url,publicmosaic.com/indicators; sid:9101928; rev:2;)
alert tls $HOME_NET any -> 51.81.80.239 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"899eb351331ebdcfaeac4aafb4b40a7b1e5602e57108a7f8faacb8de3fc196b9"; reference:url,publicmosaic.com/indicators; sid:9101929; rev:2;)
alert tcp $HOME_NET any -> 51.81.171.234 80 (msg:"HOLLOWPOINT C2 havoc"; reference:url,publicmosaic.com/indicators; sid:9100571; rev:2;)
alert tcp $HOME_NET any -> 51.81.171.234 443 (msg:"HOLLOWPOINT C2 havoc"; reference:url,publicmosaic.com/indicators; sid:9100577; rev:2;)
alert tls $HOME_NET any -> 51.81.171.234 40056 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"50037c0fdb26afebef03491c5fbd827dc9544772c85f817b235b2882f48eacbb"; reference:url,publicmosaic.com/indicators; sid:9104163; rev:2;)
alert tls $HOME_NET any -> 51.83.133.9 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"930a6af46a9ca249ce15c05f92946edd7905f4af4269d30dd06ad102f80ec442"; reference:url,publicmosaic.com/indicators; sid:9100383; rev:2;)
alert tls $HOME_NET any -> 51.83.185.120 9321 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"421decc7993427e79a9a5c546b64820a989c931857b88d0bc021b597697d08d3"; reference:url,publicmosaic.com/indicators; sid:9103703; rev:2;)
alert tcp $HOME_NET any -> 51.89.172.77 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9105786; rev:2;)
alert tls $HOME_NET any -> 51.161.9.215 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"4b0d1474b21b19bdd9c469db5c5ef7efa318b88b527ca02bf7c77f52d317314c"; reference:url,publicmosaic.com/indicators; sid:9102075; rev:2;)
alert tls $HOME_NET any -> 51.195.41.45 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"711621315aeec21118ab023d0604234ee40caa46b52792b3dcdabbfb83291cf1"; reference:url,publicmosaic.com/indicators; sid:9103702; rev:2;)
alert tls $HOME_NET any -> 51.195.202.236 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"351b887f8898691261c932799d0de10c0b338ba39dd0b67e7a63354cfb316389"; reference:url,publicmosaic.com/indicators; sid:9102074; rev:2;)
alert tcp $HOME_NET any -> 54.38.94.225 8880 (msg:"HOLLOWPOINT C2 pyramid_c2"; reference:url,publicmosaic.com/indicators; sid:9100267; rev:2;)
alert tcp $HOME_NET any -> 54.38.94.225 8881 (msg:"HOLLOWPOINT C2 pyramid_c2"; reference:url,publicmosaic.com/indicators; sid:9103798; rev:2;)
alert tcp $HOME_NET any -> 54.38.94.225 8882 (msg:"HOLLOWPOINT C2 pyramid_c2"; reference:url,publicmosaic.com/indicators; sid:9103797; rev:2;)
alert tcp $HOME_NET any -> 54.38.94.225 8883 (msg:"HOLLOWPOINT C2 pyramid_c2"; reference:url,publicmosaic.com/indicators; sid:9100265; rev:2;)
alert tcp $HOME_NET any -> 54.38.94.225 8884 (msg:"HOLLOWPOINT C2 pyramid_c2"; reference:url,publicmosaic.com/indicators; sid:9103796; rev:2;)
alert tcp $HOME_NET any -> 54.38.94.225 8885 (msg:"HOLLOWPOINT C2 pyramid_c2"; reference:url,publicmosaic.com/indicators; sid:9103795; rev:2;)
alert tcp $HOME_NET any -> 54.38.94.225 8886 (msg:"HOLLOWPOINT C2 pyramid_c2"; reference:url,publicmosaic.com/indicators; sid:9100264; rev:2;)
alert tcp $HOME_NET any -> 54.38.94.225 8887 (msg:"HOLLOWPOINT C2 pyramid_c2"; reference:url,publicmosaic.com/indicators; sid:9103794; rev:2;)
alert tcp $HOME_NET any -> 54.39.99.113 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9105785; rev:2;)
alert tls $HOME_NET any -> 57.129.110.30 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"47b99cddc4f529533c4cb8252d441fffae99f5ea683bcee45629957d835ade61"; reference:url,publicmosaic.com/indicators; sid:9100381; rev:2;)
alert tcp $HOME_NET any -> 57.129.119.130 5173 (msg:"HOLLOWPOINT C2 overlord"; reference:url,publicmosaic.com/indicators; sid:9102073; rev:2;)
alert tls $HOME_NET any -> 79.137.77.63 9443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"985fb8bdf4ca11e99e94d491bcd909f6aaec0ea53d4535b54ad15a5c40dce3aa"; reference:url,publicmosaic.com/indicators; sid:9105342; rev:2;)
alert tls $HOME_NET any -> 79.137.77.63 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"2df141e49ad1c4f2da70b3d93d57b20157ee3bed59803fa70343e0891c3f0170"; reference:url,publicmosaic.com/indicators; sid:9104999; rev:2;)
alert tcp $HOME_NET any -> 137.74.171.99 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9105286; rev:2;)
alert tls $HOME_NET any -> 139.99.144.141 443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"2601179921049a7160d1d4dda0784ff9a59e45a1c772d4e4b318ab1778fc7923"; reference:url,publicmosaic.com/indicators; sid:9106062; rev:2;)
alert tcp $HOME_NET any -> 141.94.95.38 4444 (msg:"HOLLOWPOINT C2 adaptix"; reference:url,publicmosaic.com/indicators; sid:9100650; rev:2;)
alert tcp $HOME_NET any -> 141.94.121.162 6060 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9102276; rev:2;)
alert tls $HOME_NET any -> 141.94.121.162 6663 (msg:"HOLLOWPOINT C2 dcrat"; tls.cert_fingerprint; content:"a19ec99e1870fd21a03c185ab37075100246ba7007b47ccac16d706c19839a8e"; reference:url,publicmosaic.com/indicators; sid:9100178; rev:2;)
alert tls $HOME_NET any -> 141.94.121.162 6667 (msg:"HOLLOWPOINT C2 dcrat"; tls.cert_fingerprint; content:"a19ec99e1870fd21a03c185ab37075100246ba7007b47ccac16d706c19839a8e"; reference:url,publicmosaic.com/indicators; sid:9100177; rev:2;)
alert tcp $HOME_NET any -> 141.94.121.162 6668 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9104004; rev:2;)
alert tcp $HOME_NET any -> 141.94.121.162 6673 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9103828; rev:2;)
alert tls $HOME_NET any -> 141.94.145.72 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"ac38c8e70b7f623abe06fe913758bc3ff4698bb31712fceafdb87c56b224cbf6"; reference:url,publicmosaic.com/indicators; sid:9102053; rev:2;)
alert tls $HOME_NET any -> 144.217.94.115 443 (msg:"HOLLOWPOINT C2 evilginx"; tls.cert_fingerprint; content:"610f4b94689b74546333752e870a3a0e4557bbc3aeb865408b8773c80c148506"; reference:url,publicmosaic.com/indicators; sid:9103867; rev:2;)
alert tls $HOME_NET any -> 145.239.73.139 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"42d5f695e7a95050d5bb6b355004d8dcde8ebeab71ea5f9da9dbec187310d9af"; reference:url,publicmosaic.com/indicators; sid:9106009; rev:2;)
alert tls $HOME_NET any -> 145.239.73.139 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"64d6bc6ab51aa22033e7f63b213ea40f9de38f9c20f2b82a006302f0b6872ecc"; reference:url,publicmosaic.com/indicators; sid:9106208; rev:2;)
alert tls $HOME_NET any -> 146.59.63.41 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"9fd4199d09d74413b0e91d093b7d85ebadbab79bb1dc56acfc36bef2e206ddce"; reference:url,publicmosaic.com/indicators; sid:9106745; rev:2;)
alert tls $HOME_NET any -> 146.59.63.41 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"45032b5ac8d78fa8c5166e8febc00c1079c05fc5d86a908e1a1bc6f088ffcfe4"; reference:url,publicmosaic.com/indicators; sid:9104250; rev:2;)
alert tcp $HOME_NET any -> 146.59.153.194 8443 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9104501; rev:2;)
alert tcp $HOME_NET any -> 148.113.58.127 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9103312; rev:2;)
alert tcp $HOME_NET any -> 148.113.59.45 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9103311; rev:2;)
alert tcp $HOME_NET any -> 148.113.59.191 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9104000; rev:2;)
alert tls $HOME_NET any -> 149.56.12.194 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"88855d525e815fe5b7016229f69e862c643b4f95999398193902da16e668ad8a"; reference:url,publicmosaic.com/indicators; sid:9100331; rev:2;)
alert tls $HOME_NET any -> 149.202.227.107 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"4df1befb045ec1aeda258abb8e10c3509a74c6eec0005eddb7d5f9d2e4bfb05b"; reference:url,publicmosaic.com/indicators; sid:9100462; rev:2;)
alert tls $HOME_NET any -> 149.202.227.107 8443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"ce8454cebc9dc243ab31676e608f9fb420fb9a4c13172dd7b7e68c4205ef62fe"; reference:url,publicmosaic.com/indicators; sid:9100604; rev:2;)
alert tcp $HOME_NET any -> 164.132.104.177 80 (msg:"HOLLOWPOINT C2 havoc"; reference:url,publicmosaic.com/indicators; sid:9103875; rev:2;)
alert tls $HOME_NET any -> 178.32.16.167 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9106070; rev:2;)
alert tls $HOME_NET any -> 192.99.70.186 443 (msg:"HOLLOWPOINT C2 evilginx"; tls.cert_fingerprint; content:"5e1c9493146c24e2741c9b10faa74da4a5e7c9a09d3951f2a52999eaa2034150"; reference:url,publicmosaic.com/indicators; sid:9101707; rev:2;)
alert tcp $HOME_NET any -> 193.70.100.109 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9101599; rev:2;)
alert tls $HOME_NET any -> 198.100.154.163 8443 (msg:"HOLLOWPOINT C2 bianlian"; tls.cert_fingerprint; content:"ecc932a64f0322dfc778ac28b3d63030802c022bbf5a513479abe2da6b049db2"; reference:url,publicmosaic.com/indicators; sid:9103756; rev:2;)
alert tls $HOME_NET any -> 198.100.154.163 8444 (msg:"HOLLOWPOINT C2 bianlian"; tls.cert_fingerprint; content:"7446507ef6814c22d13c28d34b4d31fe1cf43061dfb61c14d224ff650caeca62"; reference:url,publicmosaic.com/indicators; sid:9103755; rev:2;)