# hollowpoint.rules — generated 2026-09-15 10:08 UTC — 60 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: asn 401701 — https://publicmosaic.com/asn/401701
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 4
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tcp $HOME_NET any -> 38.76.169.233 8081 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103173; rev:2;)
alert tls $HOME_NET any -> 38.76.183.197 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9106621; rev:2;)
alert tls $HOME_NET any -> 38.76.188.210 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"1f052e8ae9bed6cad4cd9f452aa481c5f185bdf2e296f226edb3ba49a1e47bb6"; reference:url,publicmosaic.com/indicators; sid:9106828; rev:2;)
alert tcp $HOME_NET any -> 38.76.190.209 8090 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9106659; rev:2;)
alert tcp $HOME_NET any -> 38.76.201.200 33333 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103172; rev:2;)
alert tcp $HOME_NET any -> 38.76.202.152 9999 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104021; rev:2;)
alert tls $HOME_NET any -> 38.76.205.40 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"c8ab7a0cd506e68088e888f3fab03c209aed006b96eb3df556702126f15bb91f"; reference:url,publicmosaic.com/indicators; sid:9104687; rev:2;)
alert tls $HOME_NET any -> 38.76.215.245 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"721bbae3a4dfbc6c128cac360e9a36073d38649c8a2177d8299bec21cb4d029a"; reference:url,publicmosaic.com/indicators; sid:9101749; rev:2;)
alert tls $HOME_NET any -> 38.76.216.18 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"bc8aea6bf2d0ec28542895e0e246abce41ca97e97898acf372c89f8be773684e"; reference:url,publicmosaic.com/indicators; sid:9101839; rev:2;)
alert tls $HOME_NET any -> 38.76.216.85 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"3aec3738c0a8dfe80f99fa0eae93367e39ccb22aa02233651a69b74f29921641"; reference:url,publicmosaic.com/indicators; sid:9101842; rev:2;)
alert tcp $HOME_NET any -> 45.192.103.138 18080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106340; rev:2;)
alert tcp $HOME_NET any -> 45.192.105.32 18084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106794; rev:2;)
alert tcp $HOME_NET any -> 45.192.105.44 8080 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9103824; rev:2;)
alert tls $HOME_NET any -> 45.192.105.141 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9101201; rev:2;)
alert tcp $HOME_NET any -> 45.192.105.203 8000 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9103823; rev:2;)
alert tcp $HOME_NET any -> 45.192.109.43 8888 (msg:"HOLLOWPOINT C2 darksword"; reference:url,publicmosaic.com/indicators; sid:9105962; rev:2;)
alert tcp $HOME_NET any -> 45.207.193.193 1314 (msg:"HOLLOWPOINT C2 quasar_family"; reference:url,publicmosaic.com/indicators; sid:9104513; rev:2;)
alert tcp $HOME_NET any -> 45.207.194.79 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103063; rev:2;)
alert tcp $HOME_NET any -> 45.207.215.191 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103813; rev:2;)
alert tls $HOME_NET any -> 85.137.240.26 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9102237; rev:2;)
alert tls $HOME_NET any -> 103.52.152.203 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"9b53fc9bc85367828503723fff9a87d6f19220be5b9e6f1f3f2704a86d1c85ff"; reference:url,publicmosaic.com/indicators; sid:9101826; rev:2;)
alert tcp $HOME_NET any -> 103.52.153.142 8888 (msg:"HOLLOWPOINT C2 darksword"; reference:url,publicmosaic.com/indicators; sid:9105965; rev:2;)
alert tls $HOME_NET any -> 103.121.92.150 8888 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"4a7a5683884dcba19d6634c1e0ef0e13ed66e614b623d0301d18fe8fe9760bab"; reference:url,publicmosaic.com/indicators; sid:9104211; rev:2;)
alert tls $HOME_NET any -> 103.121.92.150 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"161b6d5cb63b3fe34dd2678725fdabdc514b9e6b0423bd543aca44d4ca400599"; reference:url,publicmosaic.com/indicators; sid:9100360; rev:2;)
alert tls $HOME_NET any -> 103.121.92.249 8888 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"bd4ada9c372c9dcc46b6501a109f1fd4181d236408c2ab07a3b11321b1f0f67f"; reference:url,publicmosaic.com/indicators; sid:9101713; rev:2;)
alert tls $HOME_NET any -> 103.121.92.249 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"0aa2129b4e44d2a8f3d4eafa9cb5f87822e11840acebc22e589688cadbc39ca0"; reference:url,publicmosaic.com/indicators; sid:9100123; rev:2;)
alert tls $HOME_NET any -> 103.121.95.77 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"4a1cdc7f75aa727393031adff86683518708963ab1b521bed3b35962ff7feef7"; reference:url,publicmosaic.com/indicators; sid:9106638; rev:2;)
alert tls $HOME_NET any -> 103.121.95.90 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"270975a12075bdc98d4509af067855203e4b2b5f5627963e96c63b2ac080765e"; reference:url,publicmosaic.com/indicators; sid:9100359; rev:2;)
alert tcp $HOME_NET any -> 103.212.186.12 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105849; rev:2;)
alert tcp $HOME_NET any -> 103.212.186.12 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106173; rev:2;)
alert tcp $HOME_NET any -> 103.212.186.12 8085 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106415; rev:2;)
alert tls $HOME_NET any -> 103.212.186.85 8888 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9104521; rev:2;)
alert tls $HOME_NET any -> 103.212.187.15 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"9e6144255b8977d7b81d643b9d1b748fb2d16bd775ab7324a43a156e29a4352a"; reference:url,publicmosaic.com/indicators; sid:9106197; rev:2;)
alert tcp $HOME_NET any -> 116.204.135.201 4449 (msg:"HOLLOWPOINT C2 quasar_family"; reference:url,publicmosaic.com/indicators; sid:9101664; rev:2;)
alert tcp $HOME_NET any -> 116.204.135.201 8848 (msg:"HOLLOWPOINT C2 quasar_family"; reference:url,publicmosaic.com/indicators; sid:9101663; rev:2;)
alert tls $HOME_NET any -> 149.88.73.17 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"f00953ba65cf63d1f0133f48c3693f525737baff5ca9c06d0261a837bbe4bf94"; reference:url,publicmosaic.com/indicators; sid:9100106; rev:2;)
alert tcp $HOME_NET any -> 149.88.73.69 80 (msg:"HOLLOWPOINT C2 flying_eagle"; reference:url,publicmosaic.com/indicators; sid:9101802; rev:2;)
alert tls $HOME_NET any -> 149.88.73.69 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"39c015d1a2922badbec4f3f7ab18487e70c3a854ca802bee8a44370f34f91940"; reference:url,publicmosaic.com/indicators; sid:9101801; rev:2;)
alert tcp $HOME_NET any -> 149.88.73.99 2222 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102362; rev:2;)
alert tls $HOME_NET any -> 149.88.73.101 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"c87098f9a4efa6e1ed2d39a8217c56ba0f661d4df7ac15811c21e0df444bf6aa"; reference:url,publicmosaic.com/indicators; sid:9101800; rev:2;)
alert tcp $HOME_NET any -> 149.88.73.229 8889 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104543; rev:2;)
alert tcp $HOME_NET any -> 149.88.73.230 80 (msg:"HOLLOWPOINT C2 flying_eagle"; reference:url,publicmosaic.com/indicators; sid:9101796; rev:2;)
alert tcp $HOME_NET any -> 149.88.73.236 80 (msg:"HOLLOWPOINT C2 flying_eagle"; reference:url,publicmosaic.com/indicators; sid:9101797; rev:2;)
alert tls $HOME_NET any -> 154.94.224.35 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"64c15c562b33b226ff24a42c213e09710216c853b652a078e92c37fc45246fcc"; reference:url,publicmosaic.com/indicators; sid:9103983; rev:2;)
alert tls $HOME_NET any -> 154.94.224.35 2087 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"64c15c562b33b226ff24a42c213e09710216c853b652a078e92c37fc45246fcc"; reference:url,publicmosaic.com/indicators; sid:9100031; rev:2;)
alert tcp $HOME_NET any -> 154.94.224.35 2095 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9103881; rev:2;)
alert tcp $HOME_NET any -> 154.94.224.35 2096 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9100028; rev:2;)
alert tls $HOME_NET any -> 154.219.100.47 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"88c0221e897bf5e909c0f82e3a3d3f10de2756752c2473cae2fa6c8ff8f547dd"; reference:url,publicmosaic.com/indicators; sid:9101794; rev:2;)
alert tls $HOME_NET any -> 154.219.100.114 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"88c0221e897bf5e909c0f82e3a3d3f10de2756752c2473cae2fa6c8ff8f547dd"; reference:url,publicmosaic.com/indicators; sid:9101790; rev:2;)
alert tls $HOME_NET any -> 154.219.105.134 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9102224; rev:2;)
alert tls $HOME_NET any -> 154.219.107.7 1443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"a7e1d34f51fa93ab5fad68f30b1830178b4364393cb2d04ffcf520ed83d5794b"; reference:url,publicmosaic.com/indicators; sid:9100603; rev:2;)
alert tls $HOME_NET any -> 154.219.115.123 60001 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"52e86169a6ca864d0ee5c9d87a53f7bec26ed048ca48aaf226ea8a476c91684f"; reference:url,publicmosaic.com/indicators; sid:9101509; rev:2;)
alert tls $HOME_NET any -> 154.219.115.123 61443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"1ad6642fff4b89123bdc35000ed53ef57322284a397ffc988bd5fe86594d01ce"; reference:url,publicmosaic.com/indicators; sid:9103423; rev:2;)
alert tcp $HOME_NET any -> 154.222.16.221 80 (msg:"HOLLOWPOINT C2 flying_eagle"; reference:url,publicmosaic.com/indicators; sid:9101788; rev:2;)
alert tcp $HOME_NET any -> 156.225.25.25 80 (msg:"HOLLOWPOINT C2 flying_eagle"; reference:url,publicmosaic.com/indicators; sid:9101789; rev:2;)
alert tls $HOME_NET any -> 156.225.26.28 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"07c0087513a67b4b3b0a3fd35f8e6c872668f46e9442168a6af55b30fa9b5898"; reference:url,publicmosaic.com/indicators; sid:9104003; rev:2;)
alert tls $HOME_NET any -> 156.225.26.254 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"d569f174971960b7712ad42f5704e6cf5186a9c3b3689286f00766cadfd4058b"; reference:url,publicmosaic.com/indicators; sid:9101791; rev:2;)
alert tcp $HOME_NET any -> 156.233.235.245 4449 (msg:"HOLLOWPOINT C2 quasar_family"; reference:url,publicmosaic.com/indicators; sid:9103616; rev:2;)
alert tcp $HOME_NET any -> 165.99.43.101 4445 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9104027; rev:2;)
alert tls $HOME_NET any -> 165.99.43.101 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"b95be8dc7cb1889ef7961f80f18e9e790d077aac0791cc0860ca0d4e17e3b71b"; reference:url,publicmosaic.com/indicators; sid:9105819; rev:2;)