# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 24 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: asn 31898 — https://publicmosaic.com/asn/31898
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 0
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tls $HOME_NET any -> 92.5.166.15 8888 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"ed6efc1b1901f05da36ba140ae8d82c8bebd2780bcebc8cfe4c64df3fec02720"; reference:url,publicmosaic.com/indicators; sid:9104192; rev:2;)
alert tls $HOME_NET any -> 92.5.166.15 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"72858ef4706c240bacdcdbef3e10ab2cb7f35535d953eb05c74b1d0ff42025f7"; reference:url,publicmosaic.com/indicators; sid:9103988; rev:2;)
alert tcp $HOME_NET any -> 129.80.218.92 993 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9101606; rev:2;)
alert tcp $HOME_NET any -> 129.80.218.92 8443 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9101605; rev:2;)
alert tcp $HOME_NET any -> 129.151.142.36 3391 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9104450; rev:2;)
alert tls $HOME_NET any -> 129.213.164.210 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"d34d45be274b9e23d11cf10a18c0dd1414efe7e5a45c852e6cbdbe9636fd7487"; reference:url,publicmosaic.com/indicators; sid:9101948; rev:2;)
alert tls $HOME_NET any -> 132.145.21.240 443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"baef6458bb667f644310783af0ad188eafde2a46f7c37617f8123acfca83775d"; reference:url,publicmosaic.com/indicators; sid:9106061; rev:2;)
alert tcp $HOME_NET any -> 132.145.21.240 30000 (msg:"HOLLOWPOINT C2 mythic"; reference:url,publicmosaic.com/indicators; sid:9106060; rev:2;)
alert tls $HOME_NET any -> 132.145.120.166 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"ba188f6c55e9d4d7e31f55c7cc7fee1ac0e4ed1a9771885f8c56191efe199620"; reference:url,publicmosaic.com/indicators; sid:9105154; rev:2;)
alert tls $HOME_NET any -> 132.145.126.82 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"ba188f6c55e9d4d7e31f55c7cc7fee1ac0e4ed1a9771885f8c56191efe199620"; reference:url,publicmosaic.com/indicators; sid:9105149; rev:2;)
alert tls $HOME_NET any -> 132.226.72.148 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"5252b8ea24a3c410e2869a79b74e689f9948643aedf2e6cd7313b0d1def1ba27"; reference:url,publicmosaic.com/indicators; sid:9100465; rev:2;)
alert tcp $HOME_NET any -> 132.226.72.148 10000 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102393; rev:2;)
alert tcp $HOME_NET any -> 138.2.99.199 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9103315; rev:2;)
alert tls $HOME_NET any -> 138.2.159.134 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"7643e1a93b6ef0952f0573c5e1e3237ca4f0770a1a558f659fe9ce6ccc4d7781"; reference:url,publicmosaic.com/indicators; sid:9101042; rev:2;)
alert tcp $HOME_NET any -> 145.241.198.20 80 (msg:"HOLLOWPOINT C2 unam"; reference:url,publicmosaic.com/indicators; sid:9104492; rev:2;)
alert tcp $HOME_NET any -> 146.235.216.7 54321 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104545; rev:2;)
alert tls $HOME_NET any -> 147.15.78.253 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"ce387ac3077c1d89376817969cdcb899f35a2787da0671ebfd7eecc126a675ee"; reference:url,publicmosaic.com/indicators; sid:9100332; rev:2;)
alert tcp $HOME_NET any -> 150.230.62.206 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102360; rev:2;)
alert tcp $HOME_NET any -> 152.67.33.246 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102349; rev:2;)
alert tls $HOME_NET any -> 158.101.136.18 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"ba188f6c55e9d4d7e31f55c7cc7fee1ac0e4ed1a9771885f8c56191efe199620"; reference:url,publicmosaic.com/indicators; sid:9105157; rev:2;)
alert tls $HOME_NET any -> 158.178.225.215 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"3b9c8919745e2a8a05bf9ebad0403af56ced94df2543b81f3f91ee4b8e21cde3"; reference:url,publicmosaic.com/indicators; sid:9100325; rev:2;)
alert tls $HOME_NET any -> 159.112.188.117 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"05fb6ba51b3133257f67fc7fc32878ff7a2e62b75c79d06cea9bc3b4520ebb69"; reference:url,publicmosaic.com/indicators; sid:9100101; rev:2;)
alert tls $HOME_NET any -> 161.153.76.241 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"b4c2ccb24b570008a86ef66e94379ba9aceceefbe808469e487f3d400003a832"; reference:url,publicmosaic.com/indicators; sid:9100322; rev:2;)
alert tls $HOME_NET any -> 213.35.118.205 4322 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"91fbbac758ed2725df4bc340654aec2b881bdd4c2d95f8e6651cb0a68b69ca33"; reference:url,publicmosaic.com/indicators; sid:9100065; rev:2;)