# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 12 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: asn 215659 — https://publicmosaic.com/asn/215659
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 0
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tls $HOME_NET any -> 45.38.20.38 8491 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"d8eeefec35af1c1c82454887698188be8df57f44d3759826887f49df0cfa7a95"; reference:url,publicmosaic.com/indicators; sid:9102200; rev:2;)
alert tls $HOME_NET any -> 45.38.20.110 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"2082bb589821e6d5672fbf5a5b72dc3dadc67edce303a6e7479f9b12b4a4f7ff"; reference:url,publicmosaic.com/indicators; sid:9105124; rev:2;)
alert tls $HOME_NET any -> 45.38.20.151 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"71bf5f878553803ff5a97d64bec87f661d1fc56f09fe569ac207e4ee8fd3c97f"; reference:url,publicmosaic.com/indicators; sid:9106347; rev:2;)
alert tls $HOME_NET any -> 45.38.20.151 8443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"b6e8be28cee97ffe2cce33984e6b68af9d127c1992ade2599928df295d50e6c8"; reference:url,publicmosaic.com/indicators; sid:9106346; rev:2;)
alert tls $HOME_NET any -> 45.38.20.151 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"de360b3e9f065ecfb0a814154d0a5df764ae11da43f55956875a63d78378bb60"; reference:url,publicmosaic.com/indicators; sid:9106003; rev:2;)
alert tls $HOME_NET any -> 65.87.7.11 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"498d0014fae64634d5372ed5410a0855ba45ed1a1e8c6557c849c18295188927"; reference:url,publicmosaic.com/indicators; sid:9106455; rev:2;)
alert tls $HOME_NET any -> 65.87.7.167 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"5fbcd3f53010fa0b19ea6c60f99ad1d821be08e59d9bbc8b346eaa3cc0938da9"; reference:url,publicmosaic.com/indicators; sid:9102070; rev:2;)
alert tls $HOME_NET any -> 66.78.40.24 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"178f5860b3659d634d2f3c2b7273b8e7ac096e958bf2127f96d87c873b1cf450"; reference:url,publicmosaic.com/indicators; sid:9102068; rev:2;)
alert tls $HOME_NET any -> 66.78.40.93 443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"37dc207b42768ce5b842d2dadab6a356c6c331ef37bb3d04071c3db2b23dab54"; reference:url,publicmosaic.com/indicators; sid:9105817; rev:2;)
alert tcp $HOME_NET any -> 66.78.40.230 4444 (msg:"HOLLOWPOINT C2 adaptix"; reference:url,publicmosaic.com/indicators; sid:9100665; rev:2;)
alert tls $HOME_NET any -> 150.40.117.90 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"a8db86f2b3aa7dc3b431afa18d287c68e7ef6634ed0fc485ad429f618b3ccd65"; reference:url,publicmosaic.com/indicators; sid:9103986; rev:2;)
alert tls $HOME_NET any -> 150.40.117.165 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"23a85b9886d8b19feead09ceb54b5c85d33477a3bf253315db5d9023ccb97356"; reference:url,publicmosaic.com/indicators; sid:9102048; rev:2;)