# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 149 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: asn 36352 — https://publicmosaic.com/asn/36352
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 1
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tcp $HOME_NET any -> 23.94.23.151 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103227; rev:2;)
alert tls $HOME_NET any -> 23.94.27.110 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9103802; rev:2;)
alert tcp $HOME_NET any -> 23.94.53.109 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9106781; rev:2;)
alert tcp $HOME_NET any -> 23.94.68.155 8443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104057; rev:2;)
alert tcp $HOME_NET any -> 23.94.70.197 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103226; rev:2;)
alert tcp $HOME_NET any -> 23.94.70.197 8085 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103225; rev:2;)
alert tcp $HOME_NET any -> 23.94.180.27 8880 (msg:"HOLLOWPOINT C2 quasar_family"; reference:url,publicmosaic.com/indicators; sid:9101662; rev:2;)
alert tls $HOME_NET any -> 23.94.199.11 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"54b0f32fa0d2a5d11c93914e4b195d535e6c1ebb1b29218bf3a8a136b81f7d0a"; reference:url,publicmosaic.com/indicators; sid:9102011; rev:2;)
alert tls $HOME_NET any -> 23.94.206.113 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"e06deb4fb0bcf1c557fc6d369729cff8775cffdfa4a2c8e2473984b3422a0009"; reference:url,publicmosaic.com/indicators; sid:9106006; rev:2;)
alert tcp $HOME_NET any -> 23.94.218.120 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105610; rev:2;)
alert tcp $HOME_NET any -> 23.94.218.120 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105645; rev:2;)
alert tcp $HOME_NET any -> 23.95.14.48 60001 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105865; rev:2;)
alert tls $HOME_NET any -> 23.95.17.118 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"483359bdd5c36f0bab98ac162b180326c98d9d4bfc160aa952e6189228f4622c"; reference:url,publicmosaic.com/indicators; sid:9102081; rev:2;)
alert tcp $HOME_NET any -> 23.95.48.221 81 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103224; rev:2;)
alert tcp $HOME_NET any -> 23.95.48.221 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103223; rev:2;)
alert tls $HOME_NET any -> 23.95.148.136 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"3fa0edbf0315b1fd8fa813f643fac1d09703ec623adc71a637250f394080c5f6"; reference:url,publicmosaic.com/indicators; sid:9103607; rev:2;)
alert tls $HOME_NET any -> 23.95.170.223 18443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"5e8679fb05392323dbd9f7aab52c114f334425634eea9685ab5e0df34d7b9537"; reference:url,publicmosaic.com/indicators; sid:9100285; rev:2;)
alert tcp $HOME_NET any -> 23.95.193.221 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104162; rev:2;)
alert tls $HOME_NET any -> 23.95.227.13 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"1079398ab73621301156032f1e0db7ec2e7c2be7c0294eb2d3e8ce5ed03208d2"; reference:url,publicmosaic.com/indicators; sid:9101062; rev:2;)
alert tls $HOME_NET any -> 23.95.230.28 4444 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"b9c34eb1d6b4a51e89102387b041c22073d0970be01a06fd48a8c241804ea7bb"; reference:url,publicmosaic.com/indicators; sid:9100741; rev:2;)
alert tls $HOME_NET any -> 23.95.230.28 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"3e512d0f003385b9ad48e6c6c9b055c41abdaf006326cad0ec4367053c236470"; reference:url,publicmosaic.com/indicators; sid:9100061; rev:2;)
alert tls $HOME_NET any -> 23.95.242.55 80 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"c1ab3f27443ccfcbc6eb228f0d292a5b4761f42879cc50b68b7a0215833dc87f"; reference:url,publicmosaic.com/indicators; sid:9104210; rev:2;)
alert tcp $HOME_NET any -> 23.95.242.55 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103222; rev:2;)
alert tcp $HOME_NET any -> 23.95.242.55 1080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103221; rev:2;)
alert tcp $HOME_NET any -> 23.95.242.55 8443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103220; rev:2;)
alert tcp $HOME_NET any -> 23.95.243.47 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9100994; rev:2;)
alert tcp $HOME_NET any -> 23.238.28.180 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103211; rev:2;)
alert tcp $HOME_NET any -> 23.238.28.180 58443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104022; rev:2;)
alert tcp $HOME_NET any -> 23.254.174.175 8005 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103209; rev:2;)
alert tcp $HOME_NET any -> 23.254.208.236 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103208; rev:2;)
alert tcp $HOME_NET any -> 23.254.208.236 9895 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103207; rev:2;)
alert tcp $HOME_NET any -> 23.254.219.25 8011 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103206; rev:2;)
alert tcp $HOME_NET any -> 23.254.219.25 61617 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103814; rev:2;)
alert tcp $HOME_NET any -> 23.254.242.24 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104216; rev:2;)
alert tls $HOME_NET any -> 72.11.148.165 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"bbc14d5222a952961c4082ab4263509eabbb216cde7ac9cd9ef13d2b7b5f878a"; reference:url,publicmosaic.com/indicators; sid:9101999; rev:2;)
alert tcp $HOME_NET any -> 104.129.12.12 443 (msg:"HOLLOWPOINT C2 adaptix"; reference:url,publicmosaic.com/indicators; sid:9103963; rev:2;)
alert tls $HOME_NET any -> 104.129.12.113 443 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"0dced88d0f04227def6817c0f370d7fad957d5ec5225fb51be1545c3fc6508b4"; reference:url,publicmosaic.com/indicators; sid:9101041; rev:2;)
alert tls $HOME_NET any -> 104.129.54.121 9443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"a9c2a49e139aa442464b3aa7e609e3eb8664f80c153873d33796919e4566b94c"; reference:url,publicmosaic.com/indicators; sid:9103693; rev:2;)
alert tcp $HOME_NET any -> 104.168.19.222 9000 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9101191; rev:2;)
alert tcp $HOME_NET any -> 104.168.22.209 53 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102530; rev:2;)
alert tcp $HOME_NET any -> 104.168.22.209 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104218; rev:2;)
alert tcp $HOME_NET any -> 104.168.22.209 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104217; rev:2;)
alert tcp $HOME_NET any -> 104.168.94.108 38001 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102529; rev:2;)
alert tcp $HOME_NET any -> 104.168.94.108 38002 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102528; rev:2;)
alert tcp $HOME_NET any -> 104.168.94.108 38006 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9101220; rev:2;)
alert tcp $HOME_NET any -> 104.168.102.116 80 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9101629; rev:2;)
alert tls $HOME_NET any -> 104.168.102.116 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9101479; rev:2;)
alert tls $HOME_NET any -> 104.168.102.116 8443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9101711; rev:2;)
alert tcp $HOME_NET any -> 104.168.109.192 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102527; rev:2;)
alert tcp $HOME_NET any -> 104.223.59.151 9004 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104590; rev:2;)
alert tls $HOME_NET any -> 104.223.75.156 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"e64f951c953a142339805bcf335e289d077b710dfdb3a67d2d1446158e9c9035"; reference:url,publicmosaic.com/indicators; sid:9103987; rev:2;)
alert tcp $HOME_NET any -> 107.161.86.90 5985 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104015; rev:2;)
alert tls $HOME_NET any -> 107.172.3.15 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"fc9d809067512ced9d53e2778398ed8882fa03b1da41752cd1cdba78cd631a25"; reference:url,publicmosaic.com/indicators; sid:9100532; rev:2;)
alert tcp $HOME_NET any -> 107.172.22.3 443 (msg:"HOLLOWPOINT C2 havoc"; reference:url,publicmosaic.com/indicators; sid:9100579; rev:2;)
alert tls $HOME_NET any -> 107.172.22.3 8888 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"17cf0c9c1af832741de83acb9817e35438c2afa5be09a494c415ae222f3cd6b2"; reference:url,publicmosaic.com/indicators; sid:9103953; rev:2;)
alert tcp $HOME_NET any -> 107.172.63.153 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9100958; rev:2;)
alert tcp $HOME_NET any -> 107.172.63.153 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9101190; rev:2;)
alert tls $HOME_NET any -> 107.172.72.178 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"c539ac70e565e63efc64a0bf56bc3bd3cc2a22655f5c9ce40a1c464afb77b848"; reference:url,publicmosaic.com/indicators; sid:9100355; rev:2;)
alert tcp $HOME_NET any -> 107.172.80.241 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102507; rev:2;)
alert tcp $HOME_NET any -> 107.172.90.117 4321 (msg:"HOLLOWPOINT C2 adaptix"; reference:url,publicmosaic.com/indicators; sid:9100655; rev:2;)
alert tls $HOME_NET any -> 107.172.140.187 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"45cf5ab9ac981e6677e2fca4ade763842cb3e44ae547dbe23f061c32ae75d5de"; reference:url,publicmosaic.com/indicators; sid:9100608; rev:2;)
alert tcp $HOME_NET any -> 107.172.190.252 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9100955; rev:2;)
alert tcp $HOME_NET any -> 107.172.190.252 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9100957; rev:2;)
alert tcp $HOME_NET any -> 107.172.190.252 65530 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102506; rev:2;)
alert tcp $HOME_NET any -> 107.172.201.125 59009 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103630; rev:2;)
alert tcp $HOME_NET any -> 107.172.214.214 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102505; rev:2;)
alert tls $HOME_NET any -> 107.172.217.220 12096 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"4f2bbac45d2d9766d28ef47cf52da81f7aab5b64cfb03bce4ced0e264a997bed"; reference:url,publicmosaic.com/indicators; sid:9104846; rev:2;)
alert tcp $HOME_NET any -> 107.172.255.93 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102504; rev:2;)
alert tcp $HOME_NET any -> 107.172.255.93 18989 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102503; rev:2;)
alert tcp $HOME_NET any -> 107.173.10.187 58082 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103613; rev:2;)
alert tcp $HOME_NET any -> 107.173.13.251 8083 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102502; rev:2;)
alert tcp $HOME_NET any -> 107.173.21.218 8085 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102501; rev:2;)
alert tls $HOME_NET any -> 107.173.47.158 6606 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe"; reference:url,publicmosaic.com/indicators; sid:9100112; rev:2;)
alert tls $HOME_NET any -> 107.173.47.158 7707 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe"; reference:url,publicmosaic.com/indicators; sid:9100114; rev:2;)
alert tls $HOME_NET any -> 107.173.47.158 8808 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe"; reference:url,publicmosaic.com/indicators; sid:9100113; rev:2;)
alert tcp $HOME_NET any -> 107.173.51.146 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105609; rev:2;)
alert tcp $HOME_NET any -> 107.173.51.146 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105646; rev:2;)
alert tls $HOME_NET any -> 107.173.71.55 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"751eb524a0eab32ed7fa3f41a1f05599d1019424300c62b60207ea0cefa21a42"; reference:url,publicmosaic.com/indicators; sid:9101990; rev:2;)
alert tcp $HOME_NET any -> 107.173.85.194 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102500; rev:2;)
alert tcp $HOME_NET any -> 107.173.101.114 10000 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102499; rev:2;)
alert tcp $HOME_NET any -> 107.173.144.112 8086 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105941; rev:2;)
alert tls $HOME_NET any -> 107.173.160.185 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"ba5406db3a6f183c2e9397c337094f1fd4e890f3161b2db36cf8abcad9d411b9"; reference:url,publicmosaic.com/indicators; sid:9100466; rev:2;)
alert tls $HOME_NET any -> 107.173.221.204 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"3d50cde71b375cc4db6d882384e0cf0f1e7246b8a2ec25de4790f21e0d036053"; reference:url,publicmosaic.com/indicators; sid:9101989; rev:2;)
alert tls $HOME_NET any -> 107.173.221.204 8530 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"3d50cde71b375cc4db6d882384e0cf0f1e7246b8a2ec25de4790f21e0d036053"; reference:url,publicmosaic.com/indicators; sid:9101988; rev:2;)
alert tcp $HOME_NET any -> 107.174.92.241 15672 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102498; rev:2;)
alert tcp $HOME_NET any -> 107.174.133.177 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102497; rev:2;)
alert tcp $HOME_NET any -> 107.174.186.201 8080 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102496; rev:2;)
alert tcp $HOME_NET any -> 107.174.186.201 9090 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102495; rev:2;)
alert tcp $HOME_NET any -> 107.175.49.181 3000 (msg:"HOLLOWPOINT C2 darksword"; reference:url,publicmosaic.com/indicators; sid:9105979; rev:2;)
alert tls $HOME_NET any -> 107.175.87.234 65321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"091f3fd89c76933c7ead52476f63a93a1341ca1829aeae02ccf5be240a0538c0"; reference:url,publicmosaic.com/indicators; sid:9102184; rev:2;)
alert tls $HOME_NET any -> 107.175.88.79 30305 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe"; reference:url,publicmosaic.com/indicators; sid:9100111; rev:2;)
alert tcp $HOME_NET any -> 107.175.94.184 61238 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106414; rev:2;)
alert tls $HOME_NET any -> 107.175.115.123 8443 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"3319c0ee354cd19566a2d71f6d568de3bf0ec0e31b7f183946166db2ee17f0c7"; reference:url,publicmosaic.com/indicators; sid:9101536; rev:2;)
alert tcp $HOME_NET any -> 155.94.144.168 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9100937; rev:2;)
alert tls $HOME_NET any -> 155.94.154.152 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"69eb915c0664991b382f997c487479c2e25dcec46a3f392d0824d4c1d3337c4d"; reference:url,publicmosaic.com/indicators; sid:9105165; rev:2;)
alert tls $HOME_NET any -> 167.160.189.206 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"50976afa22d82152a649fb47c70b68477089076ce14bdf600a0e2889ab52fa5e"; reference:url,publicmosaic.com/indicators; sid:9105191; rev:2;)
alert tcp $HOME_NET any -> 167.160.191.220 10008 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103483; rev:2;)
alert tcp $HOME_NET any -> 172.245.80.41 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105618; rev:2;)
alert tls $HOME_NET any -> 172.245.111.207 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"7b5f02dce6d9a1301fa4f5daf7da76aa78de304125d7ecb7322680b8754dd707"; reference:url,publicmosaic.com/indicators; sid:9105199; rev:2;)
alert tcp $HOME_NET any -> 172.245.126.122 2082 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103480; rev:2;)
alert tls $HOME_NET any -> 172.245.155.83 7080 (msg:"HOLLOWPOINT C2 hype_agent"; tls.cert_fingerprint; content:"23e64b1e39618b19315eb62beb62e1100bd170d5981cf19df1d4657b25701a08"; reference:url,publicmosaic.com/indicators; sid:9101036; rev:2;)
alert tls $HOME_NET any -> 172.245.155.83 7443 (msg:"HOLLOWPOINT C2 hype_agent"; tls.cert_fingerprint; content:"23e64b1e39618b19315eb62beb62e1100bd170d5981cf19df1d4657b25701a08"; reference:url,publicmosaic.com/indicators; sid:9101028; rev:2;)
alert tcp $HOME_NET any -> 172.245.168.240 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104009; rev:2;)
alert tls $HOME_NET any -> 172.245.195.202 8888 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"3108086a3a2bfe17c51af752d289f537cbca2fd7868d89679e28b86e3878f996"; reference:url,publicmosaic.com/indicators; sid:9100754; rev:2;)
alert tls $HOME_NET any -> 172.245.195.202 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"bd356fdb670fec502951829f382aa78bec927d1547f3515060cbbbf68911e868"; reference:url,publicmosaic.com/indicators; sid:9100097; rev:2;)
alert tls $HOME_NET any -> 172.245.209.209 7080 (msg:"HOLLOWPOINT C2 hype_agent"; tls.cert_fingerprint; content:"a51a5a04d7a2217b4e91be635f7d4064e61355a888665e7b8b25aeb6cf66fcd6"; reference:url,publicmosaic.com/indicators; sid:9101023; rev:2;)
alert tls $HOME_NET any -> 172.245.209.209 7443 (msg:"HOLLOWPOINT C2 hype_agent"; tls.cert_fingerprint; content:"a51a5a04d7a2217b4e91be635f7d4064e61355a888665e7b8b25aeb6cf66fcd6"; reference:url,publicmosaic.com/indicators; sid:9101033; rev:2;)
alert tcp $HOME_NET any -> 173.254.211.27 2096 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105671; rev:2;)
alert tcp $HOME_NET any -> 185.174.101.69 8000 (msg:"HOLLOWPOINT C2 pyramid_c2"; reference:url,publicmosaic.com/indicators; sid:9103789; rev:2;)
alert tcp $HOME_NET any -> 185.174.101.240 8000 (msg:"HOLLOWPOINT C2 pyramid_c2"; reference:url,publicmosaic.com/indicators; sid:9103788; rev:2;)
alert tls $HOME_NET any -> 185.174.102.5 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"59894e7c37cac9f0fa21ce41fbd7b9f2f247235dc14ed91af124e3a262924457"; reference:url,publicmosaic.com/indicators; sid:9105812; rev:2;)
alert tls $HOME_NET any -> 192.3.84.131 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"d9b23c9d340cd2e477ef8130ba43adef7550e335920872c754d0a54e0ba64de7"; reference:url,publicmosaic.com/indicators; sid:9101981; rev:2;)
alert tls $HOME_NET any -> 192.3.84.131 8570 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"d9b23c9d340cd2e477ef8130ba43adef7550e335920872c754d0a54e0ba64de7"; reference:url,publicmosaic.com/indicators; sid:9101980; rev:2;)
alert tcp $HOME_NET any -> 192.3.98.166 55555 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102667; rev:2;)
alert tls $HOME_NET any -> 192.3.134.25 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"422fd06a4732b81196a5a4ff1706f3e2fd077e095ae73a5cdb48c30475ab3823"; reference:url,publicmosaic.com/indicators; sid:9101979; rev:2;)
alert tcp $HOME_NET any -> 192.3.136.229 4782 (msg:"HOLLOWPOINT C2 quasar_rat"; reference:url,publicmosaic.com/indicators; sid:9106780; rev:2;)
alert tcp $HOME_NET any -> 192.3.139.18 8443 (msg:"HOLLOWPOINT C2 adaptix"; reference:url,publicmosaic.com/indicators; sid:9100633; rev:2;)
alert tls $HOME_NET any -> 192.3.139.18 15221 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"649a78c13fe1d2f5d905ed4e178a8d994138829868f5260fed7eed3e66e8d954"; reference:url,publicmosaic.com/indicators; sid:9103358; rev:2;)
alert tcp $HOME_NET any -> 192.3.211.176 19999 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103472; rev:2;)
alert tcp $HOME_NET any -> 192.129.141.183 7777 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9101168; rev:2;)
alert tcp $HOME_NET any -> 192.129.141.183 9999 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102665; rev:2;)
alert tcp $HOME_NET any -> 192.129.141.183 18886 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102664; rev:2;)
alert tls $HOME_NET any -> 192.210.150.212 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"de69393340667265b804ecabc46abe39971c940d884a9dff80ff9ff4a22a6f8b"; reference:url,publicmosaic.com/indicators; sid:9102031; rev:2;)
alert tcp $HOME_NET any -> 192.210.193.156 8090 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105870; rev:2;)
alert tls $HOME_NET any -> 192.210.248.125 9030 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"b942da41bc459768dd164b14108fff17e3c8ad7b5bfa7fc9831c439aa69c99ab"; reference:url,publicmosaic.com/indicators; sid:9101976; rev:2;)
alert tcp $HOME_NET any -> 192.227.167.203 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102655; rev:2;)
alert tcp $HOME_NET any -> 192.227.221.43 80 (msg:"HOLLOWPOINT C2 overlord"; reference:url,publicmosaic.com/indicators; sid:9101026; rev:2;)
alert tls $HOME_NET any -> 192.227.221.43 443 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"ec6b6a69c3ea0cea7d2652e5cbc7823820af5699f1d2c80b1a91fae854fe7071"; reference:url,publicmosaic.com/indicators; sid:9101025; rev:2;)
alert tls $HOME_NET any -> 192.227.221.43 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"ec6b6a69c3ea0cea7d2652e5cbc7823820af5699f1d2c80b1a91fae854fe7071"; reference:url,publicmosaic.com/indicators; sid:9101030; rev:2;)
alert tls $HOME_NET any -> 192.227.223.69 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"5b1caf2c1b58438fac5c7ca19a6c01fc19afe18cff79ca9679f6328cf9a79234"; reference:url,publicmosaic.com/indicators; sid:9101975; rev:2;)
alert tcp $HOME_NET any -> 192.227.235.182 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104086; rev:2;)
alert tcp $HOME_NET any -> 192.227.235.182 50000 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104308; rev:2;)
alert tcp $HOME_NET any -> 198.12.77.134 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105620; rev:2;)
alert tls $HOME_NET any -> 198.23.177.203 443 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"e52875259537dc47b1bda26a02b5ad15f2a7eb0adf77a619d63b5fab91f557c2"; reference:url,publicmosaic.com/indicators; sid:9102024; rev:2;)
alert tls $HOME_NET any -> 198.23.177.203 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"e52875259537dc47b1bda26a02b5ad15f2a7eb0adf77a619d63b5fab91f557c2"; reference:url,publicmosaic.com/indicators; sid:9102023; rev:2;)
alert tls $HOME_NET any -> 198.23.177.206 7080 (msg:"HOLLOWPOINT C2 hype_agent"; tls.cert_fingerprint; content:"2eca4348bdcacb07429ede65dd5ff4eb80c3e50a1d608e36a05083ea7fc1eb42"; reference:url,publicmosaic.com/indicators; sid:9101021; rev:2;)
alert tls $HOME_NET any -> 198.23.177.206 7443 (msg:"HOLLOWPOINT C2 hype_agent"; tls.cert_fingerprint; content:"2eca4348bdcacb07429ede65dd5ff4eb80c3e50a1d608e36a05083ea7fc1eb42"; reference:url,publicmosaic.com/indicators; sid:9101020; rev:2;)
alert tls $HOME_NET any -> 198.23.177.210 7080 (msg:"HOLLOWPOINT C2 hype_agent"; tls.cert_fingerprint; content:"75d7ca9e050181c2341915c8d42eff29dcbe824530a91b5c768bed7caea5476c"; reference:url,publicmosaic.com/indicators; sid:9101278; rev:2;)
alert tls $HOME_NET any -> 198.23.177.210 7443 (msg:"HOLLOWPOINT C2 hype_agent"; tls.cert_fingerprint; content:"75d7ca9e050181c2341915c8d42eff29dcbe824530a91b5c768bed7caea5476c"; reference:url,publicmosaic.com/indicators; sid:9101279; rev:2;)
alert tls $HOME_NET any -> 198.23.196.130 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9103388; rev:2;)
alert tcp $HOME_NET any -> 198.23.228.112 39001 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9101152; rev:2;)
alert tls $HOME_NET any -> 198.23.237.142 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"5a7551fbeb4a8125d1d8fa43799419b3bfa97e216106aba81544c69cf9134fee"; reference:url,publicmosaic.com/indicators; sid:9104106; rev:2;)
alert tcp $HOME_NET any -> 198.46.159.243 2086 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105619; rev:2;)
alert tcp $HOME_NET any -> 198.46.189.155 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102643; rev:2;)
alert tcp $HOME_NET any -> 204.152.217.122 8443 (msg:"HOLLOWPOINT C2 evilginx"; reference:url,publicmosaic.com/indicators; sid:9101471; rev:2;)
alert tls $HOME_NET any -> 204.152.220.114 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"8eb2f358a6be5bc06e80774468287efbcd5cac74220b30fda5936614ba8f482f"; reference:url,publicmosaic.com/indicators; sid:9100291; rev:2;)
alert tcp $HOME_NET any -> 206.217.136.195 53 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102611; rev:2;)
alert tcp $HOME_NET any -> 206.217.136.195 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102610; rev:2;)
alert tls $HOME_NET any -> 216.144.228.135 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"063ccb1e607e77f787ae609539c016f8008b3c299ef3804ad7375fcb252aa7a9"; reference:url,publicmosaic.com/indicators; sid:9102022; rev:2;)