# hollowpoint.rules — generated 2026-09-15 10:08 UTC — 25 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: asn 396982 — https://publicmosaic.com/asn/396982
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 0
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tcp $HOME_NET any -> 34.14.122.215 443 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9106086; rev:2;)
alert tcp $HOME_NET any -> 34.19.22.113 8081 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9104453; rev:2;)
alert tcp $HOME_NET any -> 34.19.22.113 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9103330; rev:2;)
alert tls $HOME_NET any -> 34.21.159.88 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"f7f306fba19b7cd7c482db8f3ef967876939741da4a59bfc3d0b0a6cd8d252a3"; reference:url,publicmosaic.com/indicators; sid:9101846; rev:2;)
alert tls $HOME_NET any -> 34.24.127.255 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"3ce35033240e4dcffa9c05a5c5a20dfd8e3f7c5277fe748ebae77f81d36f3982"; reference:url,publicmosaic.com/indicators; sid:9100155; rev:2;)
alert tls $HOME_NET any -> 34.45.74.63 80 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe"; reference:url,publicmosaic.com/indicators; sid:9100156; rev:2;)
alert tls $HOME_NET any -> 34.53.161.27 35382 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"44fa6a07e4316ced77141b3ea3610eb64a9b8d43ba3f7564011b828fce83380f"; reference:url,publicmosaic.com/indicators; sid:9100054; rev:2;)
alert tls $HOME_NET any -> 34.55.91.26 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"ed46923dc889e41520aaa84b8f7314e7805f1908725d8d8c14cfcbbddf65441e"; reference:url,publicmosaic.com/indicators; sid:9106779; rev:2;)
alert tls $HOME_NET any -> 34.56.42.78 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100585; rev:2;)
alert tls $HOME_NET any -> 34.68.221.226 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100210; rev:2;)
alert tcp $HOME_NET any -> 34.92.128.98 80 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9100252; rev:2;)
alert tls $HOME_NET any -> 34.92.128.98 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"2797d96c72a0f4ec7856a69585297ac1579f60cf2ab780012a88c9339e1e1a26"; reference:url,publicmosaic.com/indicators; sid:9100422; rev:2;)
alert tcp $HOME_NET any -> 34.92.225.25 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9100993; rev:2;)
alert tls $HOME_NET any -> 34.96.225.28 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"39ee4aeb38ac570c2a780143bc97742e1998fce40a9b900dae0d1316b9b10135"; reference:url,publicmosaic.com/indicators; sid:9102010; rev:2;)
alert tcp $HOME_NET any -> 34.116.213.177 5173 (msg:"HOLLOWPOINT C2 overlord"; reference:url,publicmosaic.com/indicators; sid:9102080; rev:2;)
alert tls $HOME_NET any -> 34.122.21.68 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"7b03f443dbbc0f6cf6cce392413c040ebb96c8734ac8a08369d370a91293dc3a"; reference:url,publicmosaic.com/indicators; sid:9100396; rev:2;)
alert tls $HOME_NET any -> 34.134.117.89 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"5d4c0f9c90a16c6fe1f273307be9d4d7af4f65d63682a8f9593b76e0ee6b5c72"; reference:url,publicmosaic.com/indicators; sid:9106076; rev:2;)
alert tls $HOME_NET any -> 34.150.91.139 443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"05ab52a87640ad42b9b999768e8e106e5c61959a4f27f530fa087bcadeecf677"; reference:url,publicmosaic.com/indicators; sid:9100540; rev:2;)
alert tls $HOME_NET any -> 34.175.95.87 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"d27e8956cbf257a7e52316e455d60d53609742404d5f98b0c0d1c1d74b09d836"; reference:url,publicmosaic.com/indicators; sid:9100399; rev:2;)
alert tcp $HOME_NET any -> 34.186.150.169 6932 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9103648; rev:2;)
alert tls $HOME_NET any -> 35.229.230.203 21 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"4ae678f17b451c07afc106103c6e90fc93f9e6122e42d05563564769b9c6ae16"; reference:url,publicmosaic.com/indicators; sid:9100055; rev:2;)
alert tls $HOME_NET any -> 35.240.178.188 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"9604c6724d1f0ba1c38ba48d2bf48167339a1bc7ffde6177a41d494fc90fb391"; reference:url,publicmosaic.com/indicators; sid:9100718; rev:2;)
alert tls $HOME_NET any -> 35.240.178.188 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"6a8f31031eb8e91f03536f8fd8e3004236a735a718526fae8e1fee7cda8bd709"; reference:url,publicmosaic.com/indicators; sid:9100397; rev:2;)
alert tls $HOME_NET any -> 136.64.24.207 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"ec8ef7d476c5acb1f17a289b9209eacebeaf50ff1cf1786dda8e408ef9d62858"; reference:url,publicmosaic.com/indicators; sid:9104998; rev:2;)
alert tls $HOME_NET any -> 136.110.51.183 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"83566176e4fd65f15421e7a19b8b291fa8becc139462b9a256b2ff9bcfebaeb3"; reference:url,publicmosaic.com/indicators; sid:9100344; rev:2;)