# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 95 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: asn 20473 — https://publicmosaic.com/asn/20473
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 1
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tls $HOME_NET any -> 45.32.165.7 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"1154766444df8cc471804678124ec5d8cd634092a2c97f2b15f612a5f129fa0c"; reference:url,publicmosaic.com/indicators; sid:9100739; rev:2;)
alert tls $HOME_NET any -> 45.63.43.183 4445 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"bbaea640195bdd22b89e6e382480d2cc2ae53fd3b5d68cc5f9f2a1546721bea5"; reference:url,publicmosaic.com/indicators; sid:9102268; rev:2;)
alert tls $HOME_NET any -> 45.63.43.183 4449 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"e73036c4ab2298c5969fad2641bdbd73ff31b1746f50050a6c35975f53d9f807"; reference:url,publicmosaic.com/indicators; sid:9102267; rev:2;)
alert tls $HOME_NET any -> 45.63.43.183 7000 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"f1303512bcd97a7f418cd04141581170750b5714d5db193d497e9db305696a82"; reference:url,publicmosaic.com/indicators; sid:9100144; rev:2;)
alert tls $HOME_NET any -> 45.63.43.183 8080 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"8bab38b83f330a38b03dd9c016ee342ac57e1c08f4b7edc1bf74caaf1024b3bb"; reference:url,publicmosaic.com/indicators; sid:9100143; rev:2;)
alert tcp $HOME_NET any -> 45.63.120.124 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105615; rev:2;)
alert tcp $HOME_NET any -> 45.63.120.124 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105624; rev:2;)
alert tcp $HOME_NET any -> 45.76.99.126 8888 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103096; rev:2;)
alert tcp $HOME_NET any -> 45.76.99.126 18080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103095; rev:2;)
alert tcp $HOME_NET any -> 45.76.145.171 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105613; rev:2;)
alert tcp $HOME_NET any -> 45.76.145.171 6667 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105660; rev:2;)
alert tcp $HOME_NET any -> 45.76.145.171 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105623; rev:2;)
alert tcp $HOME_NET any -> 45.76.146.82 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104472; rev:2;)
alert tcp $HOME_NET any -> 45.76.146.82 8081 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104831; rev:2;)
alert tcp $HOME_NET any -> 45.76.154.192 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9103328; rev:2;)
alert tcp $HOME_NET any -> 45.76.185.115 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103094; rev:2;)
alert tls $HOME_NET any -> 45.76.191.22 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"9d2ad995c7157bf2c279bc8534a6452e543ced4c26af0c0cba7d4078e8a6c114"; reference:url,publicmosaic.com/indicators; sid:9105676; rev:2;)
alert tls $HOME_NET any -> 45.76.191.22 4848 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"9a957a2556bc0352d1549b5658bf5a87c74fdbad5051552f6929a06f6dc55ed4"; reference:url,publicmosaic.com/indicators; sid:9101511; rev:2;)
alert tls $HOME_NET any -> 45.76.255.56 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"5e5236a26f1dc69d0c0d3b44f104ef30c3b8934b80022e9086fa07f72975eae6"; reference:url,publicmosaic.com/indicators; sid:9103834; rev:2;)
alert tcp $HOME_NET any -> 45.77.26.165 4444 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103093; rev:2;)
alert tcp $HOME_NET any -> 45.77.26.165 33454 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103092; rev:2;)
alert tcp $HOME_NET any -> 45.77.28.40 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105675; rev:2;)
alert tcp $HOME_NET any -> 45.77.28.40 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105617; rev:2;)
alert tcp $HOME_NET any -> 45.77.28.40 8443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105638; rev:2;)
alert tls $HOME_NET any -> 45.77.33.208 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"b3d8b2241b869203e7dc75cf32dac694c559c2c16ac266458060c84355a3ee5a"; reference:url,publicmosaic.com/indicators; sid:9101923; rev:2;)
alert tcp $HOME_NET any -> 45.77.38.40 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105673; rev:2;)
alert tcp $HOME_NET any -> 45.77.64.118 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9106008; rev:2;)
alert tls $HOME_NET any -> 45.77.108.203 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"4b45b2772058ee9714d563872df4eff923f3e55b702bf1eb2291c5cc5b4cf3e6"; reference:url,publicmosaic.com/indicators; sid:9102078; rev:2;)
alert tls $HOME_NET any -> 45.77.203.212 9443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"13ba5abee9772b3ed9a9ee020ee1c768fe4bff621cd2a8672a8df22fda710690"; reference:url,publicmosaic.com/indicators; sid:9100616; rev:2;)
alert tcp $HOME_NET any -> 45.77.220.145 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103091; rev:2;)
alert tcp $HOME_NET any -> 45.77.220.145 60001 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103090; rev:2;)
alert tcp $HOME_NET any -> 45.77.240.46 39756 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105334; rev:2;)
alert tcp $HOME_NET any -> 45.77.242.92 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103089; rev:2;)
alert tcp $HOME_NET any -> 45.77.255.102 80 (msg:"HOLLOWPOINT C2 adaptix"; reference:url,publicmosaic.com/indicators; sid:9105800; rev:2;)
alert tcp $HOME_NET any -> 45.77.255.102 443 (msg:"HOLLOWPOINT C2 adaptix"; reference:url,publicmosaic.com/indicators; sid:9100673; rev:2;)
alert tls $HOME_NET any -> 64.176.41.241 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"44856a76d6076bbec85dcdff8e770142c90063e773eda8f28af7e1cd15220889"; reference:url,publicmosaic.com/indicators; sid:9100714; rev:2;)
alert tls $HOME_NET any -> 64.176.41.241 8443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"c4ae080324ba02158cba6ad48d3af6d63e6330c42dadbc509618d4da5160b4af"; reference:url,publicmosaic.com/indicators; sid:9100795; rev:2;)
alert tls $HOME_NET any -> 64.176.41.241 9443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"6dbef7de82a9b3f1b278c3a0fc74d89172bf735d1744534665302d80af1db8b5"; reference:url,publicmosaic.com/indicators; sid:9105013; rev:2;)
alert tls $HOME_NET any -> 64.176.41.241 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"0c1503894c66f6a2e1c909bef122d3b2d5310cb70d45b365126dec04e18980b5"; reference:url,publicmosaic.com/indicators; sid:9100377; rev:2;)
alert tcp $HOME_NET any -> 64.176.84.14 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103979; rev:2;)
alert tls $HOME_NET any -> 64.176.199.134 8443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"6148d1645de00d483f0975c8f3bc14b56ed45ab08b52222bb2854b4db663326b"; reference:url,publicmosaic.com/indicators; sid:9101532; rev:2;)
alert tcp $HOME_NET any -> 64.176.229.71 8443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103888; rev:2;)
alert tcp $HOME_NET any -> 64.176.233.59 443 (msg:"HOLLOWPOINT C2 adaptix"; reference:url,publicmosaic.com/indicators; sid:9106647; rev:2;)
alert tls $HOME_NET any -> 64.177.112.21 50 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe"; reference:url,publicmosaic.com/indicators; sid:9101634; rev:2;)
alert tls $HOME_NET any -> 65.20.69.106 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"c6b7093c6d350fcec236e86a479edcc3819a5fab5883189975baa307b634df59"; reference:url,publicmosaic.com/indicators; sid:9101933; rev:2;)
alert tcp $HOME_NET any -> 65.20.91.137 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102933; rev:2;)
alert tcp $HOME_NET any -> 65.20.91.137 8085 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102932; rev:2;)
alert tcp $HOME_NET any -> 66.42.63.189 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104017; rev:2;)
alert tls $HOME_NET any -> 66.42.92.155 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"c47da250758565995349bf1b011e4443f1072470dbcb695daa9e4670cbe6a4ab"; reference:url,publicmosaic.com/indicators; sid:9102069; rev:2;)
alert tls $HOME_NET any -> 95.179.149.93 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"4b47a3f4688ed56c779a9322416c587c01d68ff09d566e8ad934e429356c7671"; reference:url,publicmosaic.com/indicators; sid:9101941; rev:2;)
alert tls $HOME_NET any -> 95.179.214.252 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"e238b0ffde92c913be7d3356f15d3b27e43a9b936ef83e31ccf3c3ad0663c8fe"; reference:url,publicmosaic.com/indicators; sid:9102060; rev:2;)
alert tls $HOME_NET any -> 108.61.192.191 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"7e12a25c8341f5363079451453b80ffa766703c669118f3d917bf8e737a38bbf"; reference:url,publicmosaic.com/indicators; sid:9103384; rev:2;)
alert tcp $HOME_NET any -> 108.160.138.37 8443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102494; rev:2;)
alert tls $HOME_NET any -> 137.220.51.205 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"f357051507c6c161eccbd6907de95eef24073718a6ef5f9f9f73243c51af8c1e"; reference:url,publicmosaic.com/indicators; sid:9102056; rev:2;)
alert tls $HOME_NET any -> 139.84.152.226 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"02cba045703501c064ee46b40a1635a5596fb8600f64827c527d95542a398992"; reference:url,publicmosaic.com/indicators; sid:9100801; rev:2;)
alert tcp $HOME_NET any -> 139.180.128.42 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102384; rev:2;)
alert tcp $HOME_NET any -> 139.180.219.233 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102383; rev:2;)
alert tcp $HOME_NET any -> 139.180.222.237 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102382; rev:2;)
alert tcp $HOME_NET any -> 139.180.222.237 8321 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102381; rev:2;)
alert tcp $HOME_NET any -> 144.202.26.27 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102374; rev:2;)
alert tls $HOME_NET any -> 144.202.31.39 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"7fdd940674d788d115d09ba58cae47011b651b8ec252da1e910db67f8f72513b"; reference:url,publicmosaic.com/indicators; sid:9106746; rev:2;)
alert tls $HOME_NET any -> 144.202.41.78 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"1154766444df8cc471804678124ec5d8cd634092a2c97f2b15f612a5f129fa0c"; reference:url,publicmosaic.com/indicators; sid:9100107; rev:2;)
alert tcp $HOME_NET any -> 149.28.30.98 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105674; rev:2;)
alert tcp $HOME_NET any -> 149.28.30.98 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105616; rev:2;)
alert tcp $HOME_NET any -> 149.28.30.98 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105625; rev:2;)
alert tcp $HOME_NET any -> 149.28.30.98 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105927; rev:2;)
alert tcp $HOME_NET any -> 149.28.30.98 8086 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105926; rev:2;)
alert tcp $HOME_NET any -> 149.28.30.98 8088 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105654; rev:2;)
alert tcp $HOME_NET any -> 149.28.30.98 8090 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105928; rev:2;)
alert tcp $HOME_NET any -> 149.28.132.51 8089 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102367; rev:2;)
alert tcp $HOME_NET any -> 149.28.135.144 8083 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102366; rev:2;)
alert tcp $HOME_NET any -> 149.28.139.62 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102365; rev:2;)
alert tls $HOME_NET any -> 155.138.148.143 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"3e433cd6dbfabb90429aa7b1e0e05fbb36df9f0fc866357afeed3831223c53c2"; reference:url,publicmosaic.com/indicators; sid:9101968; rev:2;)
alert tls $HOME_NET any -> 155.138.215.87 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"58e2bbeb8ee14fba1ac67cdcd1bf881ca8781e382f625dcdf2a4198ba9259df3"; reference:url,publicmosaic.com/indicators; sid:9103361; rev:2;)
alert tcp $HOME_NET any -> 167.179.76.179 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9101441; rev:2;)
alert tls $HOME_NET any -> 173.199.70.174 80 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"620710d952c181e3e4a5476b01f6625f21516b7bdcb072f40dd0ea6961641850"; reference:url,publicmosaic.com/indicators; sid:9100693; rev:2;)
alert tls $HOME_NET any -> 198.13.47.210 4432 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"15be9e6179d84dd48a419945a51c178aa88a3fdc609661f2de2634908372e23b"; reference:url,publicmosaic.com/indicators; sid:9105337; rev:2;)
alert tls $HOME_NET any -> 198.13.51.245 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"e580e149b5b2307ec5ca3b694c95bbdd02b696e3fab1b7ced19ad1e7c1bc7bb1"; reference:url,publicmosaic.com/indicators; sid:9101881; rev:2;)
alert tcp $HOME_NET any -> 202.182.101.229 80 (msg:"HOLLOWPOINT C2 adaptix"; reference:url,publicmosaic.com/indicators; sid:9100628; rev:2;)
alert tcp $HOME_NET any -> 202.182.101.229 5001 (msg:"HOLLOWPOINT C2 adaptix"; reference:url,publicmosaic.com/indicators; sid:9100625; rev:2;)
alert tcp $HOME_NET any -> 202.182.102.83 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102639; rev:2;)
alert tcp $HOME_NET any -> 202.182.102.83 50299 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106128; rev:2;)
alert tcp $HOME_NET any -> 207.148.64.94 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9101521; rev:2;)
alert tcp $HOME_NET any -> 207.148.74.81 62161 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102595; rev:2;)
alert tcp $HOME_NET any -> 207.148.92.205 8889 (msg:"HOLLOWPOINT C2 darksword"; reference:url,publicmosaic.com/indicators; sid:9105974; rev:2;)
alert tls $HOME_NET any -> 207.148.122.131 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"0b6a6c3661565591defc516f7292b264b965e1bac86cc78b8f94dbb2c51bca0d"; reference:url,publicmosaic.com/indicators; sid:9100626; rev:2;)
alert tcp $HOME_NET any -> 207.148.126.156 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9100928; rev:2;)
alert tcp $HOME_NET any -> 207.148.126.156 28884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9101205; rev:2;)
alert tcp $HOME_NET any -> 208.167.245.124 7771 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106295; rev:2;)
alert tcp $HOME_NET any -> 208.167.245.124 9991 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106294; rev:2;)
alert tcp $HOME_NET any -> 208.167.245.124 9993 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106293; rev:2;)
alert tcp $HOME_NET any -> 208.167.245.124 18884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106292; rev:2;)
alert tcp $HOME_NET any -> 208.167.245.124 18889 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106392; rev:2;)
alert tcp $HOME_NET any -> 208.167.245.124 52661 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106291; rev:2;)
alert tls $HOME_NET any -> 216.128.142.66 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"cfacb87ffd6c51424ee84489791fdf078df9cb5ac2821cdc251a0103eaf564c2"; reference:url,publicmosaic.com/indicators; sid:9106566; rev:2;)