# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 8 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: asn 39287 — https://publicmosaic.com/asn/39287
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 0
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tls $HOME_NET any -> 45.142.142.252 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"62873998e5506d92ab4a1a3ba488d2f1f064175c0701a30a80d1ea7a4fffb320"; reference:url,publicmosaic.com/indicators; sid:9100672; rev:2;)
alert tls $HOME_NET any -> 45.142.143.152 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"f1eb2ca305968ad4abac611a6f53ea7c38d0dfdcf40e3b8aea141d5102cd6f72"; reference:url,publicmosaic.com/indicators; sid:9100669; rev:2;)
alert tls $HOME_NET any -> 45.142.143.176 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"f3079f3c8841f6dd06b44434fc5d198c19855ab3e48d6e86da3315a23aa9f6c1"; reference:url,publicmosaic.com/indicators; sid:9100772; rev:2;)
alert tls $HOME_NET any -> 45.142.143.176 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"e5a8ac41a22549eaf7a5e2e6345e26e0e449980859debb231df679a124a7d5a4"; reference:url,publicmosaic.com/indicators; sid:9100771; rev:2;)
alert tls $HOME_NET any -> 45.158.116.86 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"ecb709d84a940032af26e3d32caf9315db7a87005aa1fab14ef3a68123edf915"; reference:url,publicmosaic.com/indicators; sid:9103874; rev:2;)
alert tls $HOME_NET any -> 80.78.22.202 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"01aa87fee54745537460edf1d2042035b0988fa660f9067904b0db3904057a75"; reference:url,publicmosaic.com/indicators; sid:9105799; rev:2;)
alert tls $HOME_NET any -> 80.78.27.42 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"b5eb6a8ee67b7ffd0a6f4ba064b70e5396e445bda5060558bf0b83ed27d0b196"; reference:url,publicmosaic.com/indicators; sid:9100663; rev:2;)
alert tls $HOME_NET any -> 185.193.127.10 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"0cbce5d34d388b2289bc84e55f0264231057f0bd681970b0bb33421ac10d2db3"; reference:url,publicmosaic.com/indicators; sid:9100598; rev:2;)