# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 88 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: asn 16509 — https://publicmosaic.com/asn/16509
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 3
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tls $HOME_NET any -> 3.6.16.126 443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"cd12eb84a86f7b392fb12b7c92ca538e88a83373e429b5936aabe0d6d1169113"; reference:url,publicmosaic.com/indicators; sid:9106468; rev:2;)
alert tls $HOME_NET any -> 3.21.191.242 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"f7577aa5210643bc9a26da3e9eb1c731a9586a3a83142ab19f0fed9b7e1c196f"; reference:url,publicmosaic.com/indicators; sid:9101915; rev:2;)
alert tcp $HOME_NET any -> 3.39.249.68 8888 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9103974; rev:2;)
alert tls $HOME_NET any -> 3.39.249.68 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"c828620a0146c0a400664411620ef3c68102294cb6b9c8df35ec80f8529389c3"; reference:url,publicmosaic.com/indicators; sid:9103719; rev:2;)
alert tls $HOME_NET any -> 3.39.249.68 40056 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"ecccb50c92d8465b5c037c0f2505ee8767326e544d90021723d34d1a653c4831"; reference:url,publicmosaic.com/indicators; sid:9103975; rev:2;)
alert tcp $HOME_NET any -> 3.67.112.102 27452 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9101677; rev:2;)
alert tcp $HOME_NET any -> 3.76.202.212 6606 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9104175; rev:2;)
alert tcp $HOME_NET any -> 3.76.202.212 7707 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9104099; rev:2;)
alert tcp $HOME_NET any -> 3.76.202.212 8808 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9104174; rev:2;)
alert tcp $HOME_NET any -> 3.76.202.212 9999 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9104098; rev:2;)
alert tcp $HOME_NET any -> 3.96.173.64 80 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9101616; rev:2;)
alert tcp $HOME_NET any -> 3.113.147.16 21672 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9101149; rev:2;)
alert tls $HOME_NET any -> 3.121.234.29 443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"7d950f2d3db82858a7a8a908c2b89ece0539c5ac6f23332504417c680deeb379"; reference:url,publicmosaic.com/indicators; sid:9100561; rev:2;)
alert tcp $HOME_NET any -> 3.127.181.115 27452 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9101676; rev:2;)
alert tls $HOME_NET any -> 3.143.55.137 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"b3427b436c7a324889134bd23a42e8479b6263e4716c0934e22fd9cd04a2a4ec"; reference:url,publicmosaic.com/indicators; sid:9103778; rev:2;)
alert tcp $HOME_NET any -> 3.249.180.223 443 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9104002; rev:2;)
alert tcp $HOME_NET any -> 13.59.90.25 80 (msg:"HOLLOWPOINT C2 adaptix"; reference:url,publicmosaic.com/indicators; sid:9100684; rev:2;)
alert tls $HOME_NET any -> 13.158.165.149 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"05bfcaf1f44f7ad6224cabe78670a3ee78c11e5692ef94b1f6bfa56d36e8404f"; reference:url,publicmosaic.com/indicators; sid:9101918; rev:2;)
alert tcp $HOME_NET any -> 13.204.0.27 8089 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102579; rev:2;)
alert tls $HOME_NET any -> 13.205.33.34 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"7e9df8e58f071617186ad7d6ca108b28aa35c5028eb87b0d104a1d34a1b0bbe1"; reference:url,publicmosaic.com/indicators; sid:9100787; rev:2;)
alert tls $HOME_NET any -> 13.205.246.212 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"e7987fdd4a790d1e28293f93b21ee30159e255b59aff1001ba0bef3832ad65a7"; reference:url,publicmosaic.com/indicators; sid:9101560; rev:2;)
alert tcp $HOME_NET any -> 13.210.13.81 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102578; rev:2;)
alert tls $HOME_NET any -> 13.212.38.253 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"5eb5010cfeca535f9ebaf7ed3c10b8b0350a31c0c1a511f8c529a2de5e0bddd7"; reference:url,publicmosaic.com/indicators; sid:9100621; rev:2;)
alert tcp $HOME_NET any -> 13.212.111.223 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102577; rev:2;)
alert tcp $HOME_NET any -> 13.212.206.34 80 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102576; rev:2;)
alert tls $HOME_NET any -> 13.231.5.121 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"a5fe246decb3c11cbd0719aef0c1b160fd18d3640e6dcaa17466a2417980022a"; reference:url,publicmosaic.com/indicators; sid:9100702; rev:2;)
alert tcp $HOME_NET any -> 13.231.27.88 56767 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102575; rev:2;)
alert tls $HOME_NET any -> 13.236.153.60 443 (msg:"HOLLOWPOINT C2 poshc2"; tls.cert_fingerprint; content:"28817b11b5bf3fcacd0f64965caaee682f7baf9524caa44dfd523aefcee0b269"; reference:url,publicmosaic.com/indicators; sid:9100516; rev:2;)
alert tls $HOME_NET any -> 13.236.153.60 8888 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"472dcc1ee4acfca148d051ebec7c9582ff4b27413d590c59805a7fac5f93d0b7"; reference:url,publicmosaic.com/indicators; sid:9103656; rev:2;)
alert tcp $HOME_NET any -> 13.236.190.6 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102574; rev:2;)
alert tls $HOME_NET any -> 15.168.12.234 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"1e68003c2c18cf29489913cbfd9ae62b47c8d6c7d166fcb9bdf3858556b2a1a5"; reference:url,publicmosaic.com/indicators; sid:9104690; rev:2;)
alert tls $HOME_NET any -> 15.237.123.87 443 (msg:"HOLLOWPOINT exposed tool ligolo"; tls.cert_fingerprint; content:"0e2b20a9ba0c02f023445286996b1920d88dff77e85769d1adb3d097d54d8c5f"; reference:url,publicmosaic.com/indicators; sid:9101698; rev:2;)
alert tcp $HOME_NET any -> 16.162.195.211 8443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103233; rev:2;)
alert tls $HOME_NET any -> 16.171.13.191 7443 (msg:"HOLLOWPOINT C2 covenant"; tls.cert_fingerprint; content:"bc3798f029ea3bbe3603aa4e8ca58df13fcc5ef4a9c758035d82873f6788f049"; reference:url,publicmosaic.com/indicators; sid:9103305; rev:2;)
alert tcp $HOME_NET any -> 18.117.245.182 443 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9106733; rev:2;)
alert tls $HOME_NET any -> 18.136.148.19 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"0b5d7b8f19913a6aef5747f8c5afd932ab864b58c01da182938faf5900011a0e"; reference:url,publicmosaic.com/indicators; sid:9100785; rev:2;)
alert tls $HOME_NET any -> 18.136.148.19 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"bc02ffd29497187c20ccc3fc89442b3034c39d8850ec0ef0bf4fd9b1a0c30fd6"; reference:url,publicmosaic.com/indicators; sid:9100786; rev:2;)
alert tcp $HOME_NET any -> 18.139.85.136 2086 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103899; rev:2;)
alert tls $HOME_NET any -> 18.139.162.58 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"b83fe08f44d393495ed9cdf51e0640f5b1d85727353eb7809b567f76e9914c13"; reference:url,publicmosaic.com/indicators; sid:9100813; rev:2;)
alert tcp $HOME_NET any -> 18.139.222.223 81 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103624; rev:2;)
alert tcp $HOME_NET any -> 18.139.222.223 82 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104441; rev:2;)
alert tls $HOME_NET any -> 18.141.182.223 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"384bd8719c6436599e2c9359ed029793ee6344a6c49b88dbb0cb510ab212560b"; reference:url,publicmosaic.com/indicators; sid:9101920; rev:2;)
alert tls $HOME_NET any -> 18.143.169.148 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"63e8f71cc0d01b4119c2d1e2668a4116e1521c4f3e2e886e10e1ad70dde6c00c"; reference:url,publicmosaic.com/indicators; sid:9100615; rev:2;)
alert tcp $HOME_NET any -> 18.162.147.217 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103654; rev:2;)
alert tcp $HOME_NET any -> 18.163.8.203 31522 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103232; rev:2;)
alert tcp $HOME_NET any -> 18.163.8.203 31772 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104476; rev:2;)
alert tcp $HOME_NET any -> 18.171.190.112 8080 (msg:"HOLLOWPOINT C2 havoc"; reference:url,publicmosaic.com/indicators; sid:9104081; rev:2;)
alert tcp $HOME_NET any -> 18.178.31.87 65514 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103231; rev:2;)
alert tls $HOME_NET any -> 18.179.34.241 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"d2a84b84df3cc29c01559b6cd0a3c48fc473bc704c53a776fb258b4864de72d0"; reference:url,publicmosaic.com/indicators; sid:9104055; rev:2;)
alert tcp $HOME_NET any -> 18.179.34.241 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9103991; rev:2;)
alert tcp $HOME_NET any -> 18.179.119.184 80 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103230; rev:2;)
alert tls $HOME_NET any -> 34.242.163.197 31333 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"7c3b8ebe9efcc0da14ee9e1360c3b59c3e30306412f373c6d545a16143e68072"; reference:url,publicmosaic.com/indicators; sid:9105203; rev:2;)
alert tcp $HOME_NET any -> 34.243.36.28 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103199; rev:2;)
alert tls $HOME_NET any -> 35.86.129.120 4782 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"e35a96eb760cf019d619e0c91a5b66701ced08067225d907aaf9eb550c7637b0"; reference:url,publicmosaic.com/indicators; sid:9100428; rev:2;)
alert tls $HOME_NET any -> 35.179.92.211 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"dddcb6775c8ce877d14e2c9e09731bb7129fb15100929a2ecd3bebd00bdff70c"; reference:url,publicmosaic.com/indicators; sid:9100678; rev:2;)
alert tcp $HOME_NET any -> 35.179.229.71 80 (msg:"HOLLOWPOINT C2 havoc"; reference:url,publicmosaic.com/indicators; sid:9100574; rev:2;)
alert tcp $HOME_NET any -> 43.198.96.27 80 (msg:"HOLLOWPOINT C2 flying_eagle"; reference:url,publicmosaic.com/indicators; sid:9101843; rev:2;)
alert tls $HOME_NET any -> 43.198.116.85 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"b0dfc4b09a95836e7194750fb27759b00664af4685a43a07f444f07d6e98e0d1"; reference:url,publicmosaic.com/indicators; sid:9106205; rev:2;)
alert tcp $HOME_NET any -> 43.212.255.197 2096 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9106161; rev:2;)
alert tls $HOME_NET any -> 44.249.249.89 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"0e9c9291b6f77d9f65e230500c0d7fc0dc979240fde0f14a48cf885eaeecaac2"; reference:url,publicmosaic.com/indicators; sid:9103407; rev:2;)
alert tcp $HOME_NET any -> 44.255.175.80 80 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9104504; rev:2;)
alert tcp $HOME_NET any -> 47.129.3.232 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103009; rev:2;)
alert tcp $HOME_NET any -> 47.129.155.127 80 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103008; rev:2;)
alert tcp $HOME_NET any -> 47.129.155.127 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103007; rev:2;)
alert tls $HOME_NET any -> 52.29.243.233 7707 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe"; reference:url,publicmosaic.com/indicators; sid:9100767; rev:2;)
alert tls $HOME_NET any -> 52.51.21.68 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"da19ff4239ad3dbf0733c9ce8da5f1d9e07feea532fac21b89f3c1be1138f8c0"; reference:url,publicmosaic.com/indicators; sid:9104224; rev:2;)
alert tls $HOME_NET any -> 52.51.21.68 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"d860bf752f94466474dec8cee6f9f8d9868c5e2ab31c83926a6623ee19202f8b"; reference:url,publicmosaic.com/indicators; sid:9103701; rev:2;)
alert tcp $HOME_NET any -> 52.196.79.161 21672 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9101140; rev:2;)
alert tls $HOME_NET any -> 52.196.120.218 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"4fcb683a3d983b21973d67dd5b76fb52298b393655f1fa1b0b90512b60d91933"; reference:url,publicmosaic.com/indicators; sid:9101836; rev:2;)
alert tls $HOME_NET any -> 54.46.17.182 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"d61910f85b0db0998a4ac22c5945f7070ed10f115e964113f733caaf34bcd34a"; reference:url,publicmosaic.com/indicators; sid:9104118; rev:2;)
alert tls $HOME_NET any -> 54.95.7.136 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"af5b14567b6c30749bcfa058f82edb4332e41f4a457d64244758e55e89cbfe8c"; reference:url,publicmosaic.com/indicators; sid:9106354; rev:2;)
alert tcp $HOME_NET any -> 54.95.7.136 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9105027; rev:2;)
alert tcp $HOME_NET any -> 54.95.208.190 80 (msg:"HOLLOWPOINT C2 havoc"; reference:url,publicmosaic.com/indicators; sid:9101504; rev:2;)
alert tls $HOME_NET any -> 54.95.208.190 443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"a8eea2c59a3ecd38b6bad14800d9c1711afc8ad86c2a99c0ce93e9eaf4e86c32"; reference:url,publicmosaic.com/indicators; sid:9100701; rev:2;)
alert tcp $HOME_NET any -> 54.180.100.54 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102957; rev:2;)
alert tls $HOME_NET any -> 54.183.237.74 443 (msg:"HOLLOWPOINT C2 vshell"; tls.cert_fingerprint; content:"3c9905697b6d709ada162db0bdcc76a7fef047bb2b07758e7e323125ba9b954e"; reference:url,publicmosaic.com/indicators; sid:9100968; rev:2;)
alert tcp $HOME_NET any -> 54.183.237.74 18082 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101199; rev:2;)
alert tls $HOME_NET any -> 54.187.35.128 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"91ee899c99adcf76d222d0a2ed1b458305b475be78879e450466a49a3c496ef2"; reference:url,publicmosaic.com/indicators; sid:9103776; rev:2;)
alert tcp $HOME_NET any -> 54.199.206.9 21672 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9101137; rev:2;)
alert tcp $HOME_NET any -> 54.247.42.8 80 (msg:"HOLLOWPOINT C2 havoc"; reference:url,publicmosaic.com/indicators; sid:9106559; rev:2;)
alert tcp $HOME_NET any -> 65.0.216.226 80 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102934; rev:2;)
alert tls $HOME_NET any -> 65.1.70.222 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"2fb1c213ec4dd6f2a63ecf3d3d300e056142872db89da0c361640602f2849b95"; reference:url,publicmosaic.com/indicators; sid:9101248; rev:2;)
alert tls $HOME_NET any -> 65.1.70.222 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"b45ea1d96442c5956fe49f01d830e8787004ada764870a2a79c959247223f62a"; reference:url,publicmosaic.com/indicators; sid:9101289; rev:2;)
alert tls $HOME_NET any -> 78.13.51.110 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"f5147b4a99e46203ca2ca410babd3332eaf73795dc80e249932eda3087e30453"; reference:url,publicmosaic.com/indicators; sid:9101832; rev:2;)
alert tcp $HOME_NET any -> 78.13.60.90 14448 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106791; rev:2;)
alert tcp $HOME_NET any -> 78.13.60.90 15000 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102924; rev:2;)
alert tls $HOME_NET any -> 108.136.51.214 4782 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"4b18b21245e49bb46583277e4bb823cd80d0dd3cb78f1fcc7ca962746dd34a60"; reference:url,publicmosaic.com/indicators; sid:9104113; rev:2;)
alert tcp $HOME_NET any -> 175.41.169.29 80 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104008; rev:2;)