# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 17 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: asn 24940 — https://publicmosaic.com/asn/24940
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 1
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tls $HOME_NET any -> 23.88.110.42 8443 (msg:"HOLLOWPOINT C2 poshc2"; tls.cert_fingerprint; content:"a5e6524dbdb776c72eb6cc5c26947800923ab56c3050722ac05ba54193f4caef"; reference:url,publicmosaic.com/indicators; sid:9100515; rev:2;)
alert tls $HOME_NET any -> 62.238.110.216 443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"0f385de0bad6d829bc754030280a52a6302c0a3f0fb015f3047f40aa542616d5"; reference:url,publicmosaic.com/indicators; sid:9101635; rev:2;)
alert tls $HOME_NET any -> 65.21.102.4 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"2fb895201389ced3144f1cdb4433570aa790d2dfeb24aee44992d83bab778e04"; reference:url,publicmosaic.com/indicators; sid:9100614; rev:2;)
alert tls $HOME_NET any -> 65.108.231.245 443 (msg:"HOLLOWPOINT C2 quasar_family"; tls.cert_fingerprint; content:"f0e5edb6efbde650b993cab0d9abf392a6d7cbd0ab1c27544fefb38038fedaa2"; reference:url,publicmosaic.com/indicators; sid:9101309; rev:2;)
alert tls $HOME_NET any -> 77.42.75.230 8443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"28ac7c465c115bf51b02a774e04e3896a09991fb0eae73116e6af760e30c6256"; reference:url,publicmosaic.com/indicators; sid:9101934; rev:2;)
alert tls $HOME_NET any -> 77.42.75.230 8444 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"e477deebafd29dcfadb1f3c43902f8290476a9ceb255c71e2d61cb10fcb0f702"; reference:url,publicmosaic.com/indicators; sid:9104171; rev:2;)
alert tls $HOME_NET any -> 77.42.75.230 9443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"368ddd548ac9e3ec5ccc94bf68be58aa9a710bdf4c28294e638a184817f321c1"; reference:url,publicmosaic.com/indicators; sid:9104170; rev:2;)
alert tls $HOME_NET any -> 77.42.75.230 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"2d1d524bf4ee585cd5aa7666a7bcd227800b31d0099fe84b513c8e24ba776cde"; reference:url,publicmosaic.com/indicators; sid:9101297; rev:2;)
alert tls $HOME_NET any -> 91.107.211.179 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"bbafe9bdf3f025a6b68c31ab5b191b4758da54d0e4657e8ca607bfcf3c97d645"; reference:url,publicmosaic.com/indicators; sid:9100763; rev:2;)
alert tls $HOME_NET any -> 116.202.158.114 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"263bee79fa3817fe36ea49211138120eff0c2e35612005ed2675755c0f2bef91"; reference:url,publicmosaic.com/indicators; sid:9100806; rev:2;)
alert tls $HOME_NET any -> 148.251.135.156 8443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"a33ab35e8f002efaf7bd08401b035d9e74c2592692906eb4065b2cbcae8ccf59"; reference:url,publicmosaic.com/indicators; sid:9100649; rev:2;)
alert tls $HOME_NET any -> 178.104.123.237 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"d01413aebc25a90ad541ad4f942ab257996caaef5a2de5c9dee2d168e9630e4f"; reference:url,publicmosaic.com/indicators; sid:9101964; rev:2;)
alert tcp $HOME_NET any -> 178.104.160.172 9001 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103474; rev:2;)
alert tcp $HOME_NET any -> 178.104.160.172 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9101600; rev:2;)
alert tls $HOME_NET any -> 178.104.186.90 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"ad0d04810204c8182d0847d8436f0e6efb8ab4ad7dab43fda05a35f7e2c1382a"; reference:url,publicmosaic.com/indicators; sid:9100599; rev:2;)
alert tls $HOME_NET any -> 178.104.186.90 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"ad0d04810204c8182d0847d8436f0e6efb8ab4ad7dab43fda05a35f7e2c1382a"; reference:url,publicmosaic.com/indicators; sid:9106447; rev:2;)
alert tls $HOME_NET any -> 204.168.238.208 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"6e8372edb03c6e59308b371b61c8b773af1296a601ea7ce7caa83d5114488db2"; reference:url,publicmosaic.com/indicators; sid:9103676; rev:2;)