# hollowpoint.rules — generated 2026-09-15 10:08 UTC — 435 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: asn 37963 — https://publicmosaic.com/asn/37963
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 15
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tcp $HOME_NET any -> 8.129.25.140 40060 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9105821; rev:2;)
alert tcp $HOME_NET any -> 8.129.227.22 10008 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100925; rev:2;)
alert tcp $HOME_NET any -> 8.130.29.94 80 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105546; rev:2;)
alert tcp $HOME_NET any -> 8.130.190.133 8090 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103289; rev:2;)
alert tcp $HOME_NET any -> 8.130.210.211 8888 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105626; rev:2;)
alert tcp $HOME_NET any -> 8.130.215.115 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103288; rev:2;)
alert tcp $HOME_NET any -> 8.130.215.115 8085 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103287; rev:2;)
alert tcp $HOME_NET any -> 8.130.215.115 28082 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103286; rev:2;)
alert tcp $HOME_NET any -> 8.134.51.218 8098 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103659; rev:2;)
alert tcp $HOME_NET any -> 8.134.70.73 6111 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9103285; rev:2;)
alert tcp $HOME_NET any -> 8.134.70.73 7777 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9100287; rev:2;)
alert tcp $HOME_NET any -> 8.134.70.73 8111 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103284; rev:2;)
alert tcp $HOME_NET any -> 8.134.70.73 8112 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103283; rev:2;)
alert tcp $HOME_NET any -> 8.134.70.73 8113 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103282; rev:2;)
alert tls $HOME_NET any -> 8.134.70.73 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"0f25a03dd7dfdd4b18c96fd00409a700a5aff274a23c46d69af9eb9057f58733"; reference:url,publicmosaic.com/indicators; sid:9100024; rev:2;)
alert tcp $HOME_NET any -> 8.134.132.22 5022 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106420; rev:2;)
alert tcp $HOME_NET any -> 8.134.166.14 8089 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104482; rev:2;)
alert tls $HOME_NET any -> 8.134.166.14 54451 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100039; rev:2;)
alert tcp $HOME_NET any -> 8.134.194.129 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103281; rev:2;)
alert tcp $HOME_NET any -> 8.134.255.60 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103280; rev:2;)
alert tcp $HOME_NET any -> 8.134.255.60 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103279; rev:2;)
alert tcp $HOME_NET any -> 8.135.18.143 8085 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101198; rev:2;)
alert tcp $HOME_NET any -> 8.135.47.140 31001 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103278; rev:2;)
alert tcp $HOME_NET any -> 8.135.47.140 31002 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103277; rev:2;)
alert tcp $HOME_NET any -> 8.136.13.87 443 (msg:"HOLLOWPOINT C2 adaptix"; reference:url,publicmosaic.com/indicators; sid:9100685; rev:2;)
alert tls $HOME_NET any -> 8.136.13.87 7001 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"d65b05391566a3d4ee3039cdcaaaa2bfee286eef9e364b39b405ead3eabb2926"; reference:url,publicmosaic.com/indicators; sid:9101261; rev:2;)
alert tcp $HOME_NET any -> 8.137.22.68 12345 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103276; rev:2;)
alert tcp $HOME_NET any -> 8.137.78.158 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104443; rev:2;)
alert tls $HOME_NET any -> 8.137.111.232 4433 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"9bd353a8df5df3e5f52479fe6579198f4e87a5092a5b586da5ccde6a74ac554d"; reference:url,publicmosaic.com/indicators; sid:9101475; rev:2;)
alert tcp $HOME_NET any -> 8.137.149.67 80 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9100258; rev:2;)
alert tcp $HOME_NET any -> 8.137.149.67 8060 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9100284; rev:2;)
alert tcp $HOME_NET any -> 8.137.149.67 8091 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9100283; rev:2;)
alert tls $HOME_NET any -> 8.137.169.91 50000 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c376478"; reference:url,publicmosaic.com/indicators; sid:9100233; rev:2;)
alert tcp $HOME_NET any -> 8.138.0.204 80 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103275; rev:2;)
alert tcp $HOME_NET any -> 8.138.30.206 8011 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103653; rev:2;)
alert tcp $HOME_NET any -> 8.138.137.232 4564 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9103454; rev:2;)
alert tcp $HOME_NET any -> 8.138.143.229 80 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106419; rev:2;)
alert tcp $HOME_NET any -> 8.138.143.229 8081 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106820; rev:2;)
alert tcp $HOME_NET any -> 8.138.143.229 8088 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106342; rev:2;)
alert tls $HOME_NET any -> 8.138.155.217 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"c42695c4ff63883ee728ba386242833bc10745e64f82edc0a45034d11d4eb8b2"; reference:url,publicmosaic.com/indicators; sid:9103962; rev:2;)
alert tcp $HOME_NET any -> 8.138.155.217 18888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9102218; rev:2;)
alert tls $HOME_NET any -> 8.138.179.29 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9102247; rev:2;)
alert tls $HOME_NET any -> 8.138.180.67 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"b27fa6999e0473f91fab9e9e4b448f79abf4b9b9ca8636cc66d992064ca8f8e8"; reference:url,publicmosaic.com/indicators; sid:9102019; rev:2;)
alert tcp $HOME_NET any -> 8.138.180.67 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100511; rev:2;)
alert tcp $HOME_NET any -> 8.138.251.8 8083 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106474; rev:2;)
alert tcp $HOME_NET any -> 8.140.209.1 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103274; rev:2;)
alert tcp $HOME_NET any -> 8.140.232.67 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103273; rev:2;)
alert tcp $HOME_NET any -> 8.140.236.137 10000 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103272; rev:2;)
alert tcp $HOME_NET any -> 8.141.88.204 38084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103271; rev:2;)
alert tls $HOME_NET any -> 8.141.94.69 7890 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"f402d73a8cbf8e7ed61ad090aa4fb8146120d0774c0ebffbeb33c451c55e3fe7"; reference:url,publicmosaic.com/indicators; sid:9105173; rev:2;)
alert tcp $HOME_NET any -> 8.141.99.41 89 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103270; rev:2;)
alert tcp $HOME_NET any -> 8.141.99.41 7876 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103269; rev:2;)
alert tcp $HOME_NET any -> 8.141.99.41 8076 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104481; rev:2;)
alert tls $HOME_NET any -> 8.141.117.9 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"ce274088c3d60dcf2148d48a5510c86b977b953b71afeb1672b1e00e90fbd4cd"; reference:url,publicmosaic.com/indicators; sid:9106749; rev:2;)
alert tcp $HOME_NET any -> 8.145.34.111 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103268; rev:2;)
alert tcp $HOME_NET any -> 8.145.52.37 5222 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103267; rev:2;)
alert tcp $HOME_NET any -> 8.145.59.5 11112 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100924; rev:2;)
alert tls $HOME_NET any -> 8.145.60.152 4435 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9104120; rev:2;)
alert tcp $HOME_NET any -> 8.145.61.81 8090 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9105634; rev:2;)
alert tls $HOME_NET any -> 8.145.61.81 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"c482304da1a4532c7b73ca2c298bc78f3a11ba1fdd6cb792e72c285dcb4035bf"; reference:url,publicmosaic.com/indicators; sid:9106328; rev:2;)
alert tcp $HOME_NET any -> 8.145.62.66 8088 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103266; rev:2;)
alert tcp $HOME_NET any -> 8.145.62.66 10010 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103265; rev:2;)
alert tls $HOME_NET any -> 8.146.207.128 8443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"8848f4cc93d21742dd71884c06aaa159bf143b186ab5e9ed1f822fdcd8f0d489"; reference:url,publicmosaic.com/indicators; sid:9103419; rev:2;)
alert tls $HOME_NET any -> 8.146.228.220 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9106478; rev:2;)
alert tcp $HOME_NET any -> 8.146.235.16 80 (msg:"HOLLOWPOINT C2 flying_eagle"; reference:url,publicmosaic.com/indicators; sid:9106353; rev:2;)
alert tls $HOME_NET any -> 8.146.235.16 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"4acfcac0fd14e7d5750ee15e9befbd4966f9fa4f078ec004a18502a33dfdad5e"; reference:url,publicmosaic.com/indicators; sid:9105121; rev:2;)
alert tcp $HOME_NET any -> 8.147.56.196 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103264; rev:2;)
alert tcp $HOME_NET any -> 8.147.114.203 443 (msg:"HOLLOWPOINT C2 havoc"; reference:url,publicmosaic.com/indicators; sid:9104447; rev:2;)
alert tcp $HOME_NET any -> 8.148.13.91 8080 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100997; rev:2;)
alert tcp $HOME_NET any -> 8.148.13.91 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100995; rev:2;)
alert tcp $HOME_NET any -> 8.148.13.91 9000 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103891; rev:2;)
alert tcp $HOME_NET any -> 8.148.26.139 9999 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9101520; rev:2;)
alert tcp $HOME_NET any -> 8.148.71.22 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103263; rev:2;)
alert tcp $HOME_NET any -> 8.148.179.247 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106341; rev:2;)
alert tcp $HOME_NET any -> 8.148.181.158 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103262; rev:2;)
alert tcp $HOME_NET any -> 8.148.184.109 6000 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103261; rev:2;)
alert tcp $HOME_NET any -> 8.148.184.136 8228 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103260; rev:2;)
alert tls $HOME_NET any -> 8.148.185.15 3347 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"67914470cb3e73c3fcaed423fbc56b3ed19f92a317e8ed8f1faf3ec416b6ede3"; reference:url,publicmosaic.com/indicators; sid:9104486; rev:2;)
alert tcp $HOME_NET any -> 8.148.201.210 8899 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104023; rev:2;)
alert tls $HOME_NET any -> 8.148.201.210 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c376478"; reference:url,publicmosaic.com/indicators; sid:9103382; rev:2;)
alert tcp $HOME_NET any -> 8.149.139.253 8083 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103259; rev:2;)
alert tcp $HOME_NET any -> 8.152.201.69 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103258; rev:2;)
alert tcp $HOME_NET any -> 8.152.201.69 50001 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9103257; rev:2;)
alert tls $HOME_NET any -> 8.152.212.104 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"3ddcc14ae6a022660d95ef3632ef195f230fa6e1132ed6aac7c330c7a56a66d2"; reference:url,publicmosaic.com/indicators; sid:9100004; rev:2;)
alert tcp $HOME_NET any -> 8.152.214.50 80 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103256; rev:2;)
alert tcp $HOME_NET any -> 8.152.218.153 9090 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100923; rev:2;)
alert tcp $HOME_NET any -> 8.155.11.100 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103255; rev:2;)
alert tcp $HOME_NET any -> 8.156.39.163 53 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103254; rev:2;)
alert tcp $HOME_NET any -> 8.156.77.10 65323 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103253; rev:2;)
alert tcp $HOME_NET any -> 8.156.77.10 65334 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104480; rev:2;)
alert tcp $HOME_NET any -> 8.156.84.216 8811 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100922; rev:2;)
alert tls $HOME_NET any -> 8.159.146.72 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"a6b7cdccaf04daf457f29218b2b9ad57a9e6ab35b9f9e0ea58ccdc6a0abc8963"; reference:url,publicmosaic.com/indicators; sid:9100413; rev:2;)
alert tcp $HOME_NET any -> 8.160.179.57 18000 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103252; rev:2;)
alert tcp $HOME_NET any -> 8.160.179.135 80 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103946; rev:2;)
alert tcp $HOME_NET any -> 8.160.189.25 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104168; rev:2;)
alert tcp $HOME_NET any -> 8.160.189.25 8888 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103900; rev:2;)
alert tcp $HOME_NET any -> 8.162.1.240 10087 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9100037; rev:2;)
alert tcp $HOME_NET any -> 8.163.44.52 23456 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103251; rev:2;)
alert tcp $HOME_NET any -> 8.163.49.50 80 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9100259; rev:2;)
alert tls $HOME_NET any -> 8.163.49.50 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"4d79c7171e66dbb68859a76c8e6f7fd8c41cd886247e7bb95671892b03cde5a1"; reference:url,publicmosaic.com/indicators; sid:9100023; rev:2;)
alert tls $HOME_NET any -> 8.163.59.20 8008 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9106622; rev:2;)
alert tcp $HOME_NET any -> 8.163.59.20 9999 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106810; rev:2;)
alert tls $HOME_NET any -> 8.163.98.217 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"9c2a9f3ab78445641850bf12b87bd0cd88ac39275c8316406cf788ee584a60c6"; reference:url,publicmosaic.com/indicators; sid:9100133; rev:2;)
alert tcp $HOME_NET any -> 39.96.15.121 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103164; rev:2;)
alert tcp $HOME_NET any -> 39.96.59.24 21001 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103163; rev:2;)
alert tcp $HOME_NET any -> 39.96.76.250 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103675; rev:2;)
alert tcp $HOME_NET any -> 39.96.78.213 7443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103162; rev:2;)
alert tcp $HOME_NET any -> 39.96.125.59 8551 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9106424; rev:2;)
alert tls $HOME_NET any -> 39.96.125.59 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"64257fc0fac31c01a5ccd816c73ea86e639260da1604d04db869bb603c2886e6"; reference:url,publicmosaic.com/indicators; sid:9106222; rev:2;)
alert tls $HOME_NET any -> 39.96.201.230 8443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"8848f4cc93d21742dd71884c06aaa159bf143b186ab5e9ed1f822fdcd8f0d489"; reference:url,publicmosaic.com/indicators; sid:9105643; rev:2;)
alert tcp $HOME_NET any -> 39.96.210.196 13306 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103161; rev:2;)
alert tcp $HOME_NET any -> 39.97.43.242 1988 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104474; rev:2;)
alert tls $HOME_NET any -> 39.97.57.155 1222 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c376478"; reference:url,publicmosaic.com/indicators; sid:9103466; rev:2;)
alert tls $HOME_NET any -> 39.97.57.155 1223 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c376478"; reference:url,publicmosaic.com/indicators; sid:9103465; rev:2;)
alert tls $HOME_NET any -> 39.97.57.155 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c376478"; reference:url,publicmosaic.com/indicators; sid:9104836; rev:2;)
alert tcp $HOME_NET any -> 39.97.234.171 10443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101014; rev:2;)
alert tcp $HOME_NET any -> 39.98.80.107 80 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106418; rev:2;)
alert tcp $HOME_NET any -> 39.98.80.107 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106613; rev:2;)
alert tcp $HOME_NET any -> 39.98.84.209 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103160; rev:2;)
alert tcp $HOME_NET any -> 39.98.116.82 3455 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9106422; rev:2;)
alert tcp $HOME_NET any -> 39.98.116.82 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103159; rev:2;)
alert tcp $HOME_NET any -> 39.99.41.108 1236 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103158; rev:2;)
alert tls $HOME_NET any -> 39.99.237.255 1433 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"8c52b7e4d0dd6952fdb9df975065242f20d86f51bfae45a7c5a5fc2cfef803e2"; reference:url,publicmosaic.com/indicators; sid:9100153; rev:2;)
alert tcp $HOME_NET any -> 39.101.78.48 9988 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103155; rev:2;)
alert tcp $HOME_NET any -> 39.102.57.23 5555 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103947; rev:2;)
alert tls $HOME_NET any -> 39.102.58.148 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"2d62582ac0164c4968a54a859c849cf574e3b065be0e95e3a7579f02b24eef61"; reference:url,publicmosaic.com/indicators; sid:9105156; rev:2;)
alert tcp $HOME_NET any -> 39.102.58.148 55566 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9103448; rev:2;)
alert tls $HOME_NET any -> 39.102.87.142 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"3fcada07c918a0553903f4cd1522c727fd3c52368d8ca0b029886f7396ed7011"; reference:url,publicmosaic.com/indicators; sid:9104202; rev:2;)
alert tcp $HOME_NET any -> 39.102.87.142 7777 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100492; rev:2;)
alert tcp $HOME_NET any -> 39.102.125.11 4435 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9103438; rev:2;)
alert tcp $HOME_NET any -> 39.104.25.196 30064 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103157; rev:2;)
alert tcp $HOME_NET any -> 39.104.25.196 38541 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103156; rev:2;)
alert tcp $HOME_NET any -> 39.104.25.196 38542 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103154; rev:2;)
alert tcp $HOME_NET any -> 39.104.25.196 38543 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103153; rev:2;)
alert tcp $HOME_NET any -> 39.104.25.196 38544 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103152; rev:2;)
alert tcp $HOME_NET any -> 39.104.25.196 38664 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103151; rev:2;)
alert tcp $HOME_NET any -> 39.104.48.247 9999 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103150; rev:2;)
alert tls $HOME_NET any -> 39.105.16.200 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"57a05de129b30a407780ff40fb5dbfd8a1917ee3c5ca1ef280e8cf6d24097b0a"; reference:url,publicmosaic.com/indicators; sid:9102203; rev:2;)
alert tls $HOME_NET any -> 39.105.16.200 4443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"3b3912189d4c9955a186d57cfec7d5efca9d7f48be403dd5719f596a80cdf4e6"; reference:url,publicmosaic.com/indicators; sid:9101455; rev:2;)
alert tls $HOME_NET any -> 39.105.200.188 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100800; rev:2;)
alert tcp $HOME_NET any -> 39.105.201.242 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103149; rev:2;)
alert tcp $HOME_NET any -> 39.105.201.242 9999 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103148; rev:2;)
alert tcp $HOME_NET any -> 39.105.211.235 6666 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103147; rev:2;)
alert tcp $HOME_NET any -> 39.105.213.209 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106557; rev:2;)
alert tcp $HOME_NET any -> 39.106.171.189 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106631; rev:2;)
alert tcp $HOME_NET any -> 39.106.171.189 8443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103146; rev:2;)
alert tcp $HOME_NET any -> 39.106.181.245 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106612; rev:2;)
alert tcp $HOME_NET any -> 39.106.205.6 80 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9100260; rev:2;)
alert tls $HOME_NET any -> 39.106.205.6 6963 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"fe1eb6cdb7afddd1e6a74c1159a903c23859b2d58732f1534bed32905b92119e"; reference:url,publicmosaic.com/indicators; sid:9105172; rev:2;)
alert tls $HOME_NET any -> 39.107.53.141 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"30cef81dc47c66c3f07feed36449968eb610d773449a38b766212f8035e24ff2"; reference:url,publicmosaic.com/indicators; sid:9104074; rev:2;)
alert tcp $HOME_NET any -> 39.107.71.36 9999 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101013; rev:2;)
alert tcp $HOME_NET any -> 39.107.110.12 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103145; rev:2;)
alert tcp $HOME_NET any -> 39.107.110.12 9995 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103144; rev:2;)
alert tcp $HOME_NET any -> 39.107.110.12 15645 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103143; rev:2;)
alert tcp $HOME_NET any -> 39.107.139.26 80 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100990; rev:2;)
alert tcp $HOME_NET any -> 42.120.16.69 61088 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9103456; rev:2;)
alert tcp $HOME_NET any -> 47.92.166.186 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103048; rev:2;)
alert tcp $HOME_NET any -> 47.92.173.209 8045 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103047; rev:2;)
alert tls $HOME_NET any -> 47.92.208.27 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"c0829f1c1dd9e36ea9512f966f4663f14e6ea81ea0e436b2d8f43e9a1a6e845c"; reference:url,publicmosaic.com/indicators; sid:9100017; rev:2;)
alert tls $HOME_NET any -> 47.92.208.27 4466 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"789d370e692a27d3a27fcb6d788e075bea719c508b495ead51887425628cd86a"; reference:url,publicmosaic.com/indicators; sid:9103427; rev:2;)
alert tcp $HOME_NET any -> 47.92.243.178 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103046; rev:2;)
alert tcp $HOME_NET any -> 47.92.243.178 8080 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103045; rev:2;)
alert tcp $HOME_NET any -> 47.92.243.178 8443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103044; rev:2;)
alert tcp $HOME_NET any -> 47.93.9.48 60001 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103043; rev:2;)
alert tcp $HOME_NET any -> 47.93.9.48 60006 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103042; rev:2;)
alert tcp $HOME_NET any -> 47.93.90.107 59623 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104471; rev:2;)
alert tcp $HOME_NET any -> 47.93.159.68 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100985; rev:2;)
alert tls $HOME_NET any -> 47.93.159.68 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"3afea977b7a8f6f41db33eaea131ce59376d94e1af8792afad315aa03b7b76e6"; reference:url,publicmosaic.com/indicators; sid:9100388; rev:2;)
alert tcp $HOME_NET any -> 47.93.184.204 50009 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103041; rev:2;)
alert tcp $HOME_NET any -> 47.93.184.204 50010 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104439; rev:2;)
alert tcp $HOME_NET any -> 47.93.184.204 50011 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103040; rev:2;)
alert tcp $HOME_NET any -> 47.93.184.204 50015 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103039; rev:2;)
alert tcp $HOME_NET any -> 47.93.198.64 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103038; rev:2;)
alert tcp $HOME_NET any -> 47.93.236.243 30001 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103037; rev:2;)
alert tls $HOME_NET any -> 47.93.243.161 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"f3ad06f47e3f1e07a83ffcf7b51882987e69c2f16324e0aa0811a24dee1a4dcd"; reference:url,publicmosaic.com/indicators; sid:9103406; rev:2;)
alert tls $HOME_NET any -> 47.93.243.161 40218 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c376478"; reference:url,publicmosaic.com/indicators; sid:9103405; rev:2;)
alert tls $HOME_NET any -> 47.94.13.0 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9103801; rev:2;)
alert tls $HOME_NET any -> 47.94.56.71 8443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"8848f4cc93d21742dd71884c06aaa159bf143b186ab5e9ed1f822fdcd8f0d489"; reference:url,publicmosaic.com/indicators; sid:9106079; rev:2;)
alert tcp $HOME_NET any -> 47.94.108.209 8888 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105627; rev:2;)
alert tcp $HOME_NET any -> 47.94.178.217 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103811; rev:2;)
alert tcp $HOME_NET any -> 47.94.194.175 15000 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101008; rev:2;)
alert tcp $HOME_NET any -> 47.94.224.229 1111 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9101955; rev:2;)
alert tls $HOME_NET any -> 47.94.224.229 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c376478"; reference:url,publicmosaic.com/indicators; sid:9100412; rev:2;)
alert tcp $HOME_NET any -> 47.95.159.107 9004 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103036; rev:2;)
alert tcp $HOME_NET any -> 47.95.178.192 80 (msg:"HOLLOWPOINT C2 flying_eagle"; reference:url,publicmosaic.com/indicators; sid:9101840; rev:2;)
alert tls $HOME_NET any -> 47.95.178.192 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"521aca23854d1f356e1623115ade1df97ded7ac28f445ac931bc84a4be8cf00e"; reference:url,publicmosaic.com/indicators; sid:9101838; rev:2;)
alert tcp $HOME_NET any -> 47.95.192.147 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103452; rev:2;)
alert tls $HOME_NET any -> 47.95.192.147 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c376478"; reference:url,publicmosaic.com/indicators; sid:9103451; rev:2;)
alert tcp $HOME_NET any -> 47.95.192.147 50052 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9104842; rev:2;)
alert tls $HOME_NET any -> 47.95.201.24 9443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"8848f4cc93d21742dd71884c06aaa159bf143b186ab5e9ed1f822fdcd8f0d489"; reference:url,publicmosaic.com/indicators; sid:9103425; rev:2;)
alert tcp $HOME_NET any -> 47.96.87.75 1883 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106611; rev:2;)
alert tcp $HOME_NET any -> 47.96.106.127 8890 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9103626; rev:2;)
alert tcp $HOME_NET any -> 47.96.106.127 8892 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9103625; rev:2;)
alert tls $HOME_NET any -> 47.96.125.204 80 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"4bbd0a45b0df375d15f385ea9636cd2e20b73903f7da3128c6166414e78ffda5"; reference:url,publicmosaic.com/indicators; sid:9104208; rev:2;)
alert tcp $HOME_NET any -> 47.96.125.204 40945 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9103781; rev:2;)
alert tcp $HOME_NET any -> 47.96.143.115 8086 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103035; rev:2;)
alert tcp $HOME_NET any -> 47.96.176.28 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104438; rev:2;)
alert tcp $HOME_NET any -> 47.96.236.191 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105333; rev:2;)
alert tcp $HOME_NET any -> 47.97.0.198 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100979; rev:2;)
alert tcp $HOME_NET any -> 47.97.0.198 8443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100972; rev:2;)
alert tcp $HOME_NET any -> 47.97.8.45 80 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106792; rev:2;)
alert tcp $HOME_NET any -> 47.97.47.29 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103034; rev:2;)
alert tcp $HOME_NET any -> 47.97.180.244 8444 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104020; rev:2;)
alert tcp $HOME_NET any -> 47.97.199.23 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104470; rev:2;)
alert tcp $HOME_NET any -> 47.98.56.18 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103033; rev:2;)
alert tcp $HOME_NET any -> 47.98.102.101 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103032; rev:2;)
alert tcp $HOME_NET any -> 47.98.121.92 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104437; rev:2;)
alert tls $HOME_NET any -> 47.98.129.153 8848 (msg:"HOLLOWPOINT C2 dcrat"; tls.cert_fingerprint; content:"f22577107ae41c3591b0607219544c06ff926e2c67eed94e25f4fdcf3ced810e"; reference:url,publicmosaic.com/indicators; sid:9100045; rev:2;)
alert tcp $HOME_NET any -> 47.98.172.208 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103031; rev:2;)
alert tcp $HOME_NET any -> 47.98.180.229 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103030; rev:2;)
alert tcp $HOME_NET any -> 47.98.244.8 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106793; rev:2;)
alert tcp $HOME_NET any -> 47.98.245.24 7000 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104019; rev:2;)
alert tls $HOME_NET any -> 47.99.65.37 8043 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"c609d756e318d950ed824105bd3644fffe57f4d4aa66af8380bc1c84e95d529a"; reference:url,publicmosaic.com/indicators; sid:9104153; rev:2;)
alert tls $HOME_NET any -> 47.99.196.178 7001 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"6957f69ea437d37651b486d77ada3bac79b105c0148a71c4b366b5868e310c9d"; reference:url,publicmosaic.com/indicators; sid:9101259; rev:2;)
alert tcp $HOME_NET any -> 47.100.34.234 808 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103029; rev:2;)
alert tls $HOME_NET any -> 47.100.63.132 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"9b94eb2fe075d30738ae56857ae9daee6283ea891181f8fd641b9e7f2e80732f"; reference:url,publicmosaic.com/indicators; sid:9105204; rev:2;)
alert tcp $HOME_NET any -> 47.100.80.108 8888 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103028; rev:2;)
alert tcp $HOME_NET any -> 47.100.160.178 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104469; rev:2;)
alert tcp $HOME_NET any -> 47.100.187.115 19999 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103027; rev:2;)
alert tls $HOME_NET any -> 47.101.51.235 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100769; rev:2;)
alert tcp $HOME_NET any -> 47.101.172.178 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103026; rev:2;)
alert tcp $HOME_NET any -> 47.102.118.214 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100981; rev:2;)
alert tls $HOME_NET any -> 47.103.213.138 6433 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100584; rev:2;)
alert tcp $HOME_NET any -> 47.103.214.7 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103025; rev:2;)
alert tls $HOME_NET any -> 47.104.0.109 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"92e4322129c27e7bda00c79ad2c88c55172efef069d9bbe6dfc8e59a0528961d"; reference:url,publicmosaic.com/indicators; sid:9100783; rev:2;)
alert tls $HOME_NET any -> 47.104.151.217 18443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"045ffa8fe1f54c2388fbd28dc90952dcfba3ed721e4e7592082823df4c390122"; reference:url,publicmosaic.com/indicators; sid:9104282; rev:2;)
alert tcp $HOME_NET any -> 47.104.246.255 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103618; rev:2;)
alert tcp $HOME_NET any -> 47.104.248.7 8884 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9103458; rev:2;)
alert tls $HOME_NET any -> 47.104.248.7 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"4116294a89c6cbff5c74c053ceafad8c750456e0f2a9eb3519b724dd91997fd4"; reference:url,publicmosaic.com/indicators; sid:9100415; rev:2;)
alert tls $HOME_NET any -> 47.105.36.109 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100421; rev:2;)
alert tcp $HOME_NET any -> 47.105.100.60 3336 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103024; rev:2;)
alert tcp $HOME_NET any -> 47.105.100.60 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103023; rev:2;)
alert tcp $HOME_NET any -> 47.105.100.60 8086 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103022; rev:2;)
alert tls $HOME_NET any -> 47.105.109.104 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"471e41900a65fbee890ccb574212b3bfeee7c960710405ab22e8501fedd220d3"; reference:url,publicmosaic.com/indicators; sid:9101926; rev:2;)
alert tcp $HOME_NET any -> 47.105.114.163 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104468; rev:2;)
alert tls $HOME_NET any -> 47.108.25.113 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100418; rev:2;)
alert tcp $HOME_NET any -> 47.108.65.230 4433 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103021; rev:2;)
alert tls $HOME_NET any -> 47.108.140.10 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9102240; rev:2;)
alert tcp $HOME_NET any -> 47.109.46.246 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103604; rev:2;)
alert tls $HOME_NET any -> 47.109.130.74 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"0b9fe4bbaebe8e047a2b11c122b7007a9acd8514bc2856ae328333c01df877cb"; reference:url,publicmosaic.com/indicators; sid:9105176; rev:2;)
alert tcp $HOME_NET any -> 47.109.197.162 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106338; rev:2;)
alert tcp $HOME_NET any -> 47.109.198.8 6000 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9100280; rev:2;)
alert tls $HOME_NET any -> 47.109.198.8 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"463ae1eaf931717b27b6a82d67c03f8bceabe078b9e328395e453a76d120d283"; reference:url,publicmosaic.com/indicators; sid:9105195; rev:2;)
alert tls $HOME_NET any -> 47.110.42.209 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"9ad9d14bb508099a22ad7ee05066ac946f88c2fd8abe5c3e7dac49ebbc028d2c"; reference:url,publicmosaic.com/indicators; sid:9101927; rev:2;)
alert tls $HOME_NET any -> 47.110.42.209 8443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"f203293d02e06aa42e8d60f4d9870921f8f24f13e9986f838b252d4da934a010"; reference:url,publicmosaic.com/indicators; sid:9104458; rev:2;)
alert tcp $HOME_NET any -> 47.110.72.155 9999 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105858; rev:2;)
alert tcp $HOME_NET any -> 47.111.171.130 8077 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101007; rev:2;)
alert tcp $HOME_NET any -> 47.111.230.105 5000 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106337; rev:2;)
alert tcp $HOME_NET any -> 47.112.124.150 5432 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103020; rev:2;)
alert tls $HOME_NET any -> 47.113.98.42 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"a5e850cadbff10bc74313d848d7710801966b38bf4923ee37ad20c2495b3d6d0"; reference:url,publicmosaic.com/indicators; sid:9100014; rev:2;)
alert tcp $HOME_NET any -> 47.113.98.42 50060 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9103435; rev:2;)
alert tcp $HOME_NET any -> 47.113.179.196 8085 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101337; rev:2;)
alert tcp $HOME_NET any -> 47.113.179.196 8089 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105088; rev:2;)
alert tcp $HOME_NET any -> 47.113.190.244 8443 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9103450; rev:2;)
alert tls $HOME_NET any -> 47.113.190.244 50010 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"7615093d89ed09a1c628602a64a48f993325e6d9f18c23b444038588b5a8ccbe"; reference:url,publicmosaic.com/indicators; sid:9103449; rev:2;)
alert tls $HOME_NET any -> 47.113.206.140 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9103961; rev:2;)
alert tcp $HOME_NET any -> 47.115.34.48 1080 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103019; rev:2;)
alert tcp $HOME_NET any -> 47.115.34.48 1081 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103018; rev:2;)
alert tcp $HOME_NET any -> 47.115.34.48 1082 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101576; rev:2;)
alert tcp $HOME_NET any -> 47.115.200.146 5003 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103017; rev:2;)
alert tcp $HOME_NET any -> 47.115.207.5 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103016; rev:2;)
alert tcp $HOME_NET any -> 47.116.103.142 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103015; rev:2;)
alert tcp $HOME_NET any -> 47.116.111.156 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103014; rev:2;)
alert tls $HOME_NET any -> 47.116.113.15 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"9d8f783ce0268d1df5970d991fb3ab53321b68a8c32620a990495c77b6f6ac1b"; reference:url,publicmosaic.com/indicators; sid:9101647; rev:2;)
alert tcp $HOME_NET any -> 47.116.115.7 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103013; rev:2;)
alert tcp $HOME_NET any -> 47.116.217.241 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103012; rev:2;)
alert tcp $HOME_NET any -> 47.119.145.233 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103011; rev:2;)
alert tcp $HOME_NET any -> 47.120.32.72 8075 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9100281; rev:2;)
alert tls $HOME_NET any -> 47.120.32.72 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c376478"; reference:url,publicmosaic.com/indicators; sid:9100232; rev:2;)
alert tcp $HOME_NET any -> 47.120.46.170 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103890; rev:2;)
alert tls $HOME_NET any -> 47.120.46.210 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"6be6fa70608e7ceb3ddd965b296ac7cfcef4d03a10ef1c4128130cc9aa096c4d"; reference:url,publicmosaic.com/indicators; sid:9100387; rev:2;)
alert tcp $HOME_NET any -> 47.121.31.109 10000 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103010; rev:2;)
alert tls $HOME_NET any -> 47.121.136.51 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"5cc5748741d65e34659f3d19f1fc7ce16abb31f524c5ce78f7d562f2d7f92f70"; reference:url,publicmosaic.com/indicators; sid:9103706; rev:2;)
alert tcp $HOME_NET any -> 47.122.114.156 9001 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104436; rev:2;)
alert tcp $HOME_NET any -> 47.122.120.188 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103810; rev:2;)
alert tcp $HOME_NET any -> 59.110.28.230 8088 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102955; rev:2;)
alert tls $HOME_NET any -> 59.110.153.133 4444 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"d225e5e4d53b26f7de8062184dc82ef63663669ad50ee28a075294eafc9d7b6e"; reference:url,publicmosaic.com/indicators; sid:9106803; rev:2;)
alert tcp $HOME_NET any -> 59.110.153.133 8080 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9106134; rev:2;)
alert tls $HOME_NET any -> 59.110.228.141 8443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"8848f4cc93d21742dd71884c06aaa159bf143b186ab5e9ed1f822fdcd8f0d489"; reference:url,publicmosaic.com/indicators; sid:9106078; rev:2;)
alert tcp $HOME_NET any -> 60.205.95.107 5432 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103642; rev:2;)
alert tls $HOME_NET any -> 60.205.115.92 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9102239; rev:2;)
alert tcp $HOME_NET any -> 60.205.123.176 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102950; rev:2;)
alert tcp $HOME_NET any -> 60.205.164.207 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102949; rev:2;)
alert tcp $HOME_NET any -> 60.205.164.207 8085 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102948; rev:2;)
alert tls $HOME_NET any -> 101.37.22.150 4782 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"51ea33ad911106e46abf997820b4c2443a1d1acaa3ae365cd4954b29087f4de4"; reference:url,publicmosaic.com/indicators; sid:9100127; rev:2;)
alert tls $HOME_NET any -> 101.37.87.55 7443 (msg:"HOLLOWPOINT C2 covenant"; tls.cert_fingerprint; content:"97bdfb80165cab5d62f8d7d1367c382fed298012a5a9c5246bf8ba34c782ded3"; reference:url,publicmosaic.com/indicators; sid:9103303; rev:2;)
alert tcp $HOME_NET any -> 101.37.171.223 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103973; rev:2;)
alert tls $HOME_NET any -> 101.37.210.236 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"bdd6a453bdb4113cc7249dc4a7dcd3449769c0cdd2328042fd96785e24b9213f"; reference:url,publicmosaic.com/indicators; sid:9104198; rev:2;)
alert tcp $HOME_NET any -> 101.37.210.236 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9104197; rev:2;)
alert tcp $HOME_NET any -> 101.37.236.20 80 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9106194; rev:2;)
alert tls $HOME_NET any -> 101.37.236.20 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"45719a2cd37335abc7f24c3831b693bc777df333d44b893ef684dd09dbe204f8"; reference:url,publicmosaic.com/indicators; sid:9106193; rev:2;)
alert tcp $HOME_NET any -> 101.132.34.211 8085 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102891; rev:2;)
alert tcp $HOME_NET any -> 101.132.60.152 8086 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102565; rev:2;)
alert tls $HOME_NET any -> 101.132.66.50 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"9b4276f70fd0d951695d02846fe86c3686d7239ba90a985b205cd517ff218e7d"; reference:url,publicmosaic.com/indicators; sid:9104213; rev:2;)
alert tls $HOME_NET any -> 101.132.66.50 8443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"58934a755591a8abaa425f7ada1cb02307466b81fa40f3d89c7ff3721ddb1f75"; reference:url,publicmosaic.com/indicators; sid:9104214; rev:2;)
alert tcp $HOME_NET any -> 101.132.120.245 5555 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102564; rev:2;)
alert tcp $HOME_NET any -> 101.132.120.245 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102563; rev:2;)
alert tcp $HOME_NET any -> 101.132.153.5 80 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102562; rev:2;)
alert tcp $HOME_NET any -> 101.132.153.5 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103870; rev:2;)
alert tcp $HOME_NET any -> 101.133.170.144 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106335; rev:2;)
alert tls $HOME_NET any -> 101.133.172.90 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"1ec1d907300d4a85c6113622e51055a9b8e598d73e15fc1664e4036bb9bad2b4"; reference:url,publicmosaic.com/indicators; sid:9104054; rev:2;)
alert tcp $HOME_NET any -> 101.133.172.90 8787 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100498; rev:2;)
alert tcp $HOME_NET any -> 101.133.237.185 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102890; rev:2;)
alert tls $HOME_NET any -> 101.200.29.195 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"c036251d25dca54531448afcfb7517bb1951fecff56afff1b62bf42b8ae6981d"; reference:url,publicmosaic.com/indicators; sid:9103375; rev:2;)
alert tcp $HOME_NET any -> 101.200.34.196 5000 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102561; rev:2;)
alert tls $HOME_NET any -> 101.200.85.0 8443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"8848f4cc93d21742dd71884c06aaa159bf143b186ab5e9ed1f822fdcd8f0d489"; reference:url,publicmosaic.com/indicators; sid:9103420; rev:2;)
alert tcp $HOME_NET any -> 101.200.193.211 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100962; rev:2;)
alert tcp $HOME_NET any -> 101.200.193.211 8086 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9103447; rev:2;)
alert tls $HOME_NET any -> 101.200.193.211 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"cfa98cd4addeae494b424f879bd300b40028f996153159abfff78d96ca2b2cdf"; reference:url,publicmosaic.com/indicators; sid:9100748; rev:2;)
alert tls $HOME_NET any -> 101.201.103.158 8066 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9105019; rev:2;)
alert tls $HOME_NET any -> 101.201.103.158 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"98b44f7822edba8b4e4d3f6ec822ce46a32013fdf4648793972125e2926c4da2"; reference:url,publicmosaic.com/indicators; sid:9105822; rev:2;)
alert tls $HOME_NET any -> 101.201.109.2 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"ff08aca05fc74ddae8b7b8cd90681408805e81787950b8728d29ec7434ad65ea"; reference:url,publicmosaic.com/indicators; sid:9104176; rev:2;)
alert tls $HOME_NET any -> 101.201.109.2 18443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"b04a32445023dbc098ced430f4947a50d7894388f3a599d8a5b057e8cb6b671d"; reference:url,publicmosaic.com/indicators; sid:9103424; rev:2;)
alert tls $HOME_NET any -> 101.201.150.204 8888 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"53945878ce4f2c016b7ac95c05391d8dac68a01d503f0a88ffbe0253de398230"; reference:url,publicmosaic.com/indicators; sid:9102264; rev:2;)
alert tcp $HOME_NET any -> 106.14.36.132 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102884; rev:2;)
alert tcp $HOME_NET any -> 106.14.36.132 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103868; rev:2;)
alert tcp $HOME_NET any -> 106.14.53.55 1234 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102521; rev:2;)
alert tcp $HOME_NET any -> 106.14.53.55 1333 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102520; rev:2;)
alert tcp $HOME_NET any -> 106.14.58.57 8888 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102519; rev:2;)
alert tcp $HOME_NET any -> 106.14.107.71 44445 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103639; rev:2;)
alert tcp $HOME_NET any -> 106.14.155.244 8080 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103869; rev:2;)
alert tcp $HOME_NET any -> 106.14.183.219 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102883; rev:2;)
alert tcp $HOME_NET any -> 106.14.246.141 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104587; rev:2;)
alert tcp $HOME_NET any -> 106.15.10.2 6789 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9100189; rev:2;)
alert tcp $HOME_NET any -> 106.15.10.2 11111 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9100187; rev:2;)
alert tls $HOME_NET any -> 106.15.10.2 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"566826077b3c473fb10a0041e6a80ec5b9e725520c44956a6b9a23273711f025"; reference:url,publicmosaic.com/indicators; sid:9101507; rev:2;)
alert tcp $HOME_NET any -> 106.15.44.150 8080 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100960; rev:2;)
alert tcp $HOME_NET any -> 106.15.44.150 8987 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104586; rev:2;)
alert tcp $HOME_NET any -> 106.15.104.224 1234 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102882; rev:2;)
alert tcp $HOME_NET any -> 106.15.104.224 55555 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102881; rev:2;)
alert tcp $HOME_NET any -> 106.15.228.143 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102517; rev:2;)
alert tls $HOME_NET any -> 112.124.22.77 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"e897ac88ce5cffa5904613368cfebd9b4fe915a3376bcae2f8d3ab59b268675d"; reference:url,publicmosaic.com/indicators; sid:9105183; rev:2;)
alert tcp $HOME_NET any -> 112.124.44.139 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102482; rev:2;)
alert tcp $HOME_NET any -> 112.124.52.105 8085 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103633; rev:2;)
alert tcp $HOME_NET any -> 112.124.52.105 8091 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105939; rev:2;)
alert tls $HOME_NET any -> 114.55.151.60 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"21122a428605b3696f6804e609ed6f6f7e1e697eab07b1406b25ba1760e34dc1"; reference:url,publicmosaic.com/indicators; sid:9101947; rev:2;)
alert tls $HOME_NET any -> 114.55.151.60 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"52c2ba814256aa080bb25cfbe8503180525290635fea7cfdfc177ad9c9c28d41"; reference:url,publicmosaic.com/indicators; sid:9101946; rev:2;)
alert tls $HOME_NET any -> 114.215.188.153 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"5872f049081ab305513fcac0975be27712414a73d28e3105a143bd54f664ed3d"; reference:url,publicmosaic.com/indicators; sid:9106771; rev:2;)
alert tcp $HOME_NET any -> 115.29.162.68 9999 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103949; rev:2;)
alert tcp $HOME_NET any -> 115.29.202.62 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102464; rev:2;)
alert tls $HOME_NET any -> 115.29.241.139 5001 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"6ac2bf08fe2a4eff6243c21b10941a62e95a2e64eb0d166bca2ff1bb58bad9d3"; reference:url,publicmosaic.com/indicators; sid:9104148; rev:2;)
alert tcp $HOME_NET any -> 115.29.241.139 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102463; rev:2;)
alert tcp $HOME_NET any -> 116.62.64.55 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105532; rev:2;)
alert tcp $HOME_NET any -> 116.62.68.243 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102452; rev:2;)
alert tcp $HOME_NET any -> 116.62.130.3 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105331; rev:2;)
alert tcp $HOME_NET any -> 116.62.172.147 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102451; rev:2;)
alert tcp $HOME_NET any -> 116.62.172.147 8080 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102450; rev:2;)
alert tcp $HOME_NET any -> 116.62.172.147 8083 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102449; rev:2;)
alert tcp $HOME_NET any -> 116.62.172.147 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102448; rev:2;)
alert tcp $HOME_NET any -> 116.62.226.163 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102447; rev:2;)
alert tcp $HOME_NET any -> 116.62.231.55 8081 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102446; rev:2;)
alert tcp $HOME_NET any -> 118.31.2.114 8000 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104067; rev:2;)
alert tcp $HOME_NET any -> 118.31.2.114 8080 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104066; rev:2;)
alert tcp $HOME_NET any -> 118.31.221.121 8899 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103608; rev:2;)
alert tcp $HOME_NET any -> 118.178.224.93 8080 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106333; rev:2;)
alert tcp $HOME_NET any -> 120.24.144.243 16001 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105933; rev:2;)
alert tcp $HOME_NET any -> 120.26.14.56 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104674; rev:2;)
alert tcp $HOME_NET any -> 120.26.32.201 8085 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106605; rev:2;)
alert tls $HOME_NET any -> 120.26.48.207 61001 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"4c593d4e9bc1fdb1393ccdee22ee94f015784474b30321f2eb094238eafd1794"; reference:url,publicmosaic.com/indicators; sid:9105202; rev:2;)
alert tcp $HOME_NET any -> 120.26.120.83 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106604; rev:2;)
alert tcp $HOME_NET any -> 120.26.136.167 8088 (msg:"HOLLOWPOINT C2 quasar_rat"; reference:url,publicmosaic.com/indicators; sid:9106438; rev:2;)
alert tls $HOME_NET any -> 120.26.146.96 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"2f7500875b1ebb80740b25b6c31e81675adf2a3e5f3d75fa62f411d833925050"; reference:url,publicmosaic.com/indicators; sid:9103691; rev:2;)
alert tcp $HOME_NET any -> 120.26.184.232 80 (msg:"HOLLOWPOINT C2 darksword"; reference:url,publicmosaic.com/indicators; sid:9105978; rev:2;)
alert tcp $HOME_NET any -> 120.26.210.31 8089 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104094; rev:2;)
alert tcp $HOME_NET any -> 120.26.236.53 3306 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104673; rev:2;)
alert tcp $HOME_NET any -> 120.26.244.242 10081 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104672; rev:2;)
alert tcp $HOME_NET any -> 120.27.109.84 80 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106829; rev:2;)
alert tcp $HOME_NET any -> 120.27.109.84 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104671; rev:2;)
alert tcp $HOME_NET any -> 120.27.147.200 80 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103603; rev:2;)
alert tcp $HOME_NET any -> 120.27.147.200 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103602; rev:2;)
alert tcp $HOME_NET any -> 120.27.147.200 8000 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104189; rev:2;)
alert tcp $HOME_NET any -> 120.55.3.157 10000 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9103627; rev:2;)
alert tls $HOME_NET any -> 120.55.3.157 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"73291204314b17a1f060f1276cf8d2761074c0b56193f5f9b24bfe25bc476582"; reference:url,publicmosaic.com/indicators; sid:9100010; rev:2;)
alert tls $HOME_NET any -> 120.55.93.58 10080 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"42cf4165567f6b3a251e67d194b873dffc50d1f6a07d5a98b492a1bb4572d141"; reference:url,publicmosaic.com/indicators; sid:9105169; rev:2;)
alert tcp $HOME_NET any -> 120.55.93.58 10092 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9103628; rev:2;)
alert tcp $HOME_NET any -> 120.55.162.57 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104456; rev:2;)
alert tcp $HOME_NET any -> 120.55.193.6 9004 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103887; rev:2;)
alert tcp $HOME_NET any -> 120.76.143.184 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9104058; rev:2;)
alert tls $HOME_NET any -> 120.76.143.184 8899 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"6a93803e14de2b423a28e7a49e19bcc6e12bc030f0f55b998af6f099f5802dc7"; reference:url,publicmosaic.com/indicators; sid:9100273; rev:2;)
alert tcp $HOME_NET any -> 120.77.254.122 5555 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9104262; rev:2;)
alert tls $HOME_NET any -> 120.77.254.122 8888 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"25d7a38dadc1817460f942199509ca2a115fa0d07ca8d4338333c1dcd7e4d43c"; reference:url,publicmosaic.com/indicators; sid:9105828; rev:2;)
alert tcp $HOME_NET any -> 120.78.121.146 8035 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9103780; rev:2;)
alert tcp $HOME_NET any -> 120.79.22.70 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105329; rev:2;)
alert tcp $HOME_NET any -> 120.79.24.24 65001 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104669; rev:2;)
alert tcp $HOME_NET any -> 120.79.24.24 65002 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104668; rev:2;)
alert tls $HOME_NET any -> 120.79.64.164 50040 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"321ca611b00b3c7c30826456335d02c2341ca7f20cf8e80800524aa212206ba6"; reference:url,publicmosaic.com/indicators; sid:9103378; rev:2;)
alert tls $HOME_NET any -> 121.40.37.49 20086 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c376478"; reference:url,publicmosaic.com/indicators; sid:9106656; rev:2;)
alert tcp $HOME_NET any -> 121.40.156.23 4567 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102435; rev:2;)
alert tcp $HOME_NET any -> 121.40.156.23 56789 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102434; rev:2;)
alert tcp $HOME_NET any -> 121.40.176.57 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102433; rev:2;)
alert tcp $HOME_NET any -> 121.41.1.158 60086 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103619; rev:2;)
alert tcp $HOME_NET any -> 121.41.29.228 8004 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104093; rev:2;)
alert tls $HOME_NET any -> 121.43.182.95 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"f0b9efafd002c0fff391f00d46b32466d6ef1c2669897848c1b0f001aefc7148"; reference:url,publicmosaic.com/indicators; sid:9100351; rev:2;)
alert tcp $HOME_NET any -> 121.89.84.19 8080 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102432; rev:2;)
alert tcp $HOME_NET any -> 121.89.84.19 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102431; rev:2;)
alert tcp $HOME_NET any -> 121.89.94.37 1443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102430; rev:2;)
alert tcp $HOME_NET any -> 123.56.48.58 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9102214; rev:2;)
alert tls $HOME_NET any -> 123.56.48.58 8999 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"a3664e76cdc7e8153bb2f0f0bcad98b4fe570623b16b9d762fbb8aa51b13597e"; reference:url,publicmosaic.com/indicators; sid:9102213; rev:2;)
alert tcp $HOME_NET any -> 123.56.81.116 10000 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102856; rev:2;)
alert tcp $HOME_NET any -> 123.56.83.34 9999 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101527; rev:2;)
alert tcp $HOME_NET any -> 123.56.102.177 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104431; rev:2;)
alert tcp $HOME_NET any -> 123.56.116.92 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102421; rev:2;)
alert tcp $HOME_NET any -> 123.57.59.41 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106411; rev:2;)
alert tcp $HOME_NET any -> 123.57.59.41 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106332; rev:2;)
alert tcp $HOME_NET any -> 123.57.69.200 10000 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102420; rev:2;)
alert tcp $HOME_NET any -> 123.57.69.200 61250 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104296; rev:2;)
alert tcp $HOME_NET any -> 123.57.190.245 8083 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102419; rev:2;)
alert tcp $HOME_NET any -> 123.57.230.183 60091 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102855; rev:2;)
alert tcp $HOME_NET any -> 123.57.230.183 61012 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102854; rev:2;)
alert tls $HOME_NET any -> 123.57.230.199 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"462548e21b77db9f8a5845571f5ba13bb0570711a2622b0d446bb18e1571555f"; reference:url,publicmosaic.com/indicators; sid:9100822; rev:2;)
alert tcp $HOME_NET any -> 139.129.36.253 8080 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102388; rev:2;)
alert tls $HOME_NET any -> 139.196.50.117 8839 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"0b40fcf9a403fb78bbf688f3aae05f16e9ec64c6f7960fe986ddef504ad9730a"; reference:url,publicmosaic.com/indicators; sid:9104838; rev:2;)
alert tls $HOME_NET any -> 139.196.50.117 20266 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"0b40fcf9a403fb78bbf688f3aae05f16e9ec64c6f7960fe986ddef504ad9730a"; reference:url,publicmosaic.com/indicators; sid:9105181; rev:2;)
alert tcp $HOME_NET any -> 139.196.50.117 20275 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9103432; rev:2;)
alert tcp $HOME_NET any -> 139.196.111.118 8088 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9106223; rev:2;)
alert tls $HOME_NET any -> 139.196.111.118 13389 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c376478"; reference:url,publicmosaic.com/indicators; sid:9103457; rev:2;)
alert tcp $HOME_NET any -> 139.196.170.151 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104287; rev:2;)
alert tcp $HOME_NET any -> 139.196.181.1 7777 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104663; rev:2;)
alert tcp $HOME_NET any -> 139.196.181.1 8456 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105085; rev:2;)
alert tcp $HOME_NET any -> 139.196.181.1 8808 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104662; rev:2;)
alert tcp $HOME_NET any -> 139.196.181.1 8809 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104661; rev:2;)
alert tcp $HOME_NET any -> 139.196.238.43 8443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102380; rev:2;)
alert tcp $HOME_NET any -> 139.224.3.228 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104660; rev:2;)
alert tls $HOME_NET any -> 139.224.3.228 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"8bdafd7262cf74edd1872c9334dc3a52fe8df4a021f3dfd1331042a9c9412977"; reference:url,publicmosaic.com/indicators; sid:9102841; rev:2;)
alert tcp $HOME_NET any -> 182.92.62.124 51001 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102677; rev:2;)
alert tcp $HOME_NET any -> 182.92.69.30 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106018; rev:2;)
alert tcp $HOME_NET any -> 182.92.78.7 5555 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9100163; rev:2;)
alert tcp $HOME_NET any -> 182.92.117.223 80 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9100006; rev:2;)
alert tcp $HOME_NET any -> 182.92.188.8 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102676; rev:2;)
alert tcp $HOME_NET any -> 182.92.188.8 500 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102675; rev:2;)
alert tls $HOME_NET any -> 182.92.227.226 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"03e959ad76c97983cb8eb9c8f1367798dc6c194469e326dcbf70e84c41aba971"; reference:url,publicmosaic.com/indicators; sid:9101253; rev:2;)
alert tcp $HOME_NET any -> 182.92.242.6 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104007; rev:2;)
alert tcp $HOME_NET any -> 218.244.142.4 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101578; rev:2;)
alert tcp $HOME_NET any -> 218.244.142.4 8889 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9101561; rev:2;)
alert tls $HOME_NET any -> 218.244.142.4 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"aa6feed05dd52a236a440bbf777d0922ccec190001b1f07ad476c63cd7cc56fa"; reference:url,publicmosaic.com/indicators; sid:9101506; rev:2;)