# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 509 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: asn 45090 — https://publicmosaic.com/asn/45090
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 2
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tcp $HOME_NET any -> 1.12.59.176 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102588; rev:2;)
alert tcp $HOME_NET any -> 1.13.19.103 1098 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102587; rev:2;)
alert tcp $HOME_NET any -> 1.13.19.103 3312 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105549; rev:2;)
alert tcp $HOME_NET any -> 1.13.19.103 8193 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106174; rev:2;)
alert tcp $HOME_NET any -> 1.13.19.103 8443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102586; rev:2;)
alert tcp $HOME_NET any -> 1.13.19.103 8445 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104483; rev:2;)
alert tcp $HOME_NET any -> 1.13.19.103 8963 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102585; rev:2;)
alert tcp $HOME_NET any -> 1.13.91.59 5432 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102584; rev:2;)
alert tcp $HOME_NET any -> 1.13.158.52 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103295; rev:2;)
alert tls $HOME_NET any -> 1.13.165.181 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"5c48ed46502227edaa74dd3bd96c2bc568e80eb16bd4adbe212f8c3dc88ea0b0"; reference:url,publicmosaic.com/indicators; sid:9103720; rev:2;)
alert tcp $HOME_NET any -> 1.13.179.86 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101001; rev:2;)
alert tcp $HOME_NET any -> 1.13.179.86 9876 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101633; rev:2;)
alert tcp $HOME_NET any -> 1.13.251.23 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101000; rev:2;)
alert tcp $HOME_NET any -> 1.14.43.163 8082 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104599; rev:2;)
alert tcp $HOME_NET any -> 1.14.43.163 8443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102583; rev:2;)
alert tls $HOME_NET any -> 1.14.46.205 4782 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"dc2f5830ef7a7aa316b710e05805b169767edb0ada1fd91bb3969f51e19c2e9f"; reference:url,publicmosaic.com/indicators; sid:9102275; rev:2;)
alert tls $HOME_NET any -> 1.14.73.118 34091 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"e1469697b4db2de18d2aea69f1e3f3979a7943702c83332f136ab43a299fd256"; reference:url,publicmosaic.com/indicators; sid:9104692; rev:2;)
alert tcp $HOME_NET any -> 1.14.76.115 9999 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106345; rev:2;)
alert tcp $HOME_NET any -> 1.14.103.5 18443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104598; rev:2;)
alert tls $HOME_NET any -> 1.14.104.208 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"89e4016a53d764dbbad8d240c8508f3c5d57a74f862856d7a4ce3df56852f700"; reference:url,publicmosaic.com/indicators; sid:9100476; rev:2;)
alert tls $HOME_NET any -> 1.14.104.208 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"ef533656d343ef391fa3175e3d17a32a81afd387371d81bf74c9dc5277c1961d"; reference:url,publicmosaic.com/indicators; sid:9105197; rev:2;)
alert tcp $HOME_NET any -> 1.14.120.4 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106344; rev:2;)
alert tcp $HOME_NET any -> 1.14.120.4 8087 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106343; rev:2;)
alert tcp $HOME_NET any -> 1.14.120.4 8804 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106416; rev:2;)
alert tcp $HOME_NET any -> 1.14.126.124 18083 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102582; rev:2;)
alert tcp $HOME_NET any -> 1.14.136.252 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9103912; rev:2;)
alert tcp $HOME_NET any -> 1.14.191.194 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105547; rev:2;)
alert tcp $HOME_NET any -> 1.14.208.13 20000 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102581; rev:2;)
alert tls $HOME_NET any -> 1.14.234.68 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"7bb7c94b881282bcd804d0d52697a177ef6b6a8cbb5261a0589f4fe01fe4daf1"; reference:url,publicmosaic.com/indicators; sid:9101260; rev:2;)
alert tls $HOME_NET any -> 1.15.76.39 8443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100012; rev:2;)
alert tls $HOME_NET any -> 1.15.76.39 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c376478"; reference:url,publicmosaic.com/indicators; sid:9100013; rev:2;)
alert tcp $HOME_NET any -> 1.15.179.110 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100999; rev:2;)
alert tls $HOME_NET any -> 1.117.77.166 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"048564b2df9afdf5dd4051793c3d4eff047d0177ac1e93fcaf41d005b0bd941f"; reference:url,publicmosaic.com/indicators; sid:9102020; rev:2;)
alert tcp $HOME_NET any -> 1.117.77.166 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100512; rev:2;)
alert tls $HOME_NET any -> 42.193.120.28 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"6586095354d2662ccb19332ddf10b48d924d174970c6fd2aa54d2bbd422496c2"; reference:url,publicmosaic.com/indicators; sid:9100401; rev:2;)
alert tls $HOME_NET any -> 42.193.123.90 16631 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9106280; rev:2;)
alert tls $HOME_NET any -> 42.193.188.121 4782 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"dc2f5830ef7a7aa316b710e05805b169767edb0ada1fd91bb3969f51e19c2e9f"; reference:url,publicmosaic.com/indicators; sid:9102271; rev:2;)
alert tls $HOME_NET any -> 42.193.227.214 3006 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"75a363daf68ef38db1b965d5ce00c112f577414cce93c307b23746697de9ce02"; reference:url,publicmosaic.com/indicators; sid:9103381; rev:2;)
alert tcp $HOME_NET any -> 42.194.203.58 6666 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103137; rev:2;)
alert tcp $HOME_NET any -> 42.194.241.92 8181 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9104028; rev:2;)
alert tls $HOME_NET any -> 42.194.241.92 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c376478"; reference:url,publicmosaic.com/indicators; sid:9100792; rev:2;)
alert tls $HOME_NET any -> 43.136.19.18 30086 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c376478"; reference:url,publicmosaic.com/indicators; sid:9103408; rev:2;)
alert tcp $HOME_NET any -> 43.136.40.48 8088 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103126; rev:2;)
alert tcp $HOME_NET any -> 43.136.76.42 8080 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100989; rev:2;)
alert tcp $HOME_NET any -> 43.136.76.42 8081 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101203; rev:2;)
alert tls $HOME_NET any -> 43.136.93.81 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"b81cd330745d48b2b907b35812060d2a72f22ec5877eb7c2a71f650eb14036eb"; reference:url,publicmosaic.com/indicators; sid:9106133; rev:2;)
alert tcp $HOME_NET any -> 43.136.93.81 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105335; rev:2;)
alert tls $HOME_NET any -> 43.136.132.144 8443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"44910293403197211239c812e5d38a65e4c260ad8e9316225ab64ff75ff1d7ab"; reference:url,publicmosaic.com/indicators; sid:9100776; rev:2;)
alert tls $HOME_NET any -> 43.136.132.144 58443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"c157317b48f031845787877215a50708e839e0459e424a115eafa2a3d08b15e9"; reference:url,publicmosaic.com/indicators; sid:9100053; rev:2;)
alert tcp $HOME_NET any -> 43.136.180.65 9080 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101009; rev:2;)
alert tcp $HOME_NET any -> 43.137.40.36 6379 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103125; rev:2;)
alert tls $HOME_NET any -> 43.138.104.38 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100206; rev:2;)
alert tls $HOME_NET any -> 43.138.116.60 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"b337f0a1aa3508de74d20becc5085d59d8c2e911982e19767dc3a09359d11582"; reference:url,publicmosaic.com/indicators; sid:9103461; rev:2;)
alert tls $HOME_NET any -> 43.138.116.60 8443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"49469b5e904374cdfe242b2d1c7d72fc696483b16973251b33f94290c474e70a"; reference:url,publicmosaic.com/indicators; sid:9103460; rev:2;)
alert tcp $HOME_NET any -> 43.138.167.38 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100988; rev:2;)
alert tcp $HOME_NET any -> 43.138.188.218 32003 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103124; rev:2;)
alert tcp $HOME_NET any -> 43.138.210.138 44333 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103944; rev:2;)
alert tls $HOME_NET any -> 43.138.225.166 3323 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"86d13e06f082d9ec66499cb3453df171adac1db2ed3e27b3413bb2505a6afd70"; reference:url,publicmosaic.com/indicators; sid:9105182; rev:2;)
alert tcp $HOME_NET any -> 43.139.29.63 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103123; rev:2;)
alert tcp $HOME_NET any -> 43.139.108.161 8192 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9103433; rev:2;)
alert tcp $HOME_NET any -> 43.139.108.161 40010 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104473; rev:2;)
alert tls $HOME_NET any -> 43.139.108.161 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"7d9cadb480b05c944c3a4ba94a8a746d0ecba67c4b5697fcea15a52f3275445a"; reference:url,publicmosaic.com/indicators; sid:9100235; rev:2;)
alert tcp $HOME_NET any -> 43.139.173.26 12580 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9104258; rev:2;)
alert tcp $HOME_NET any -> 43.139.173.26 12581 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9104257; rev:2;)
alert tcp $HOME_NET any -> 43.139.174.4 8443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103122; rev:2;)
alert tcp $HOME_NET any -> 43.139.191.248 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103121; rev:2;)
alert tcp $HOME_NET any -> 43.139.191.248 8085 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103120; rev:2;)
alert tcp $HOME_NET any -> 43.139.208.225 80 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103119; rev:2;)
alert tcp $HOME_NET any -> 43.139.225.234 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103118; rev:2;)
alert tls $HOME_NET any -> 43.140.219.182 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100775; rev:2;)
alert tls $HOME_NET any -> 43.140.219.182 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"fc7fa97c86da9cb4a6badf161e913574a64d790b7690360861c1af7b6f27cba0"; reference:url,publicmosaic.com/indicators; sid:9100150; rev:2;)
alert tcp $HOME_NET any -> 43.142.51.69 8001 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103117; rev:2;)
alert tls $HOME_NET any -> 43.142.137.169 18443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9103421; rev:2;)
alert tcp $HOME_NET any -> 43.142.149.191 6002 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105862; rev:2;)
alert tcp $HOME_NET any -> 43.143.13.146 80 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9100151; rev:2;)
alert tcp $HOME_NET any -> 43.143.13.146 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9100978; rev:2;)
alert tcp $HOME_NET any -> 43.143.13.146 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100977; rev:2;)
alert tcp $HOME_NET any -> 43.143.14.43 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100980; rev:2;)
alert tcp $HOME_NET any -> 43.143.14.43 8088 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100975; rev:2;)
alert tcp $HOME_NET any -> 43.143.14.43 8443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100984; rev:2;)
alert tcp $HOME_NET any -> 43.143.34.190 4444 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103116; rev:2;)
alert tcp $HOME_NET any -> 43.143.34.190 12345 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103115; rev:2;)
alert tcp $HOME_NET any -> 43.143.38.95 19999 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9104841; rev:2;)
alert tls $HOME_NET any -> 43.143.57.45 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"d7eb926e0f116a4f167b7417e61e83863e52bcb4d143f6a555df320d6e954da2"; reference:url,publicmosaic.com/indicators; sid:9102201; rev:2;)
alert tls $HOME_NET any -> 43.143.94.53 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9102245; rev:2;)
alert tcp $HOME_NET any -> 43.143.148.215 8011 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103114; rev:2;)
alert tcp $HOME_NET any -> 43.143.206.225 3306 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103113; rev:2;)
alert tcp $HOME_NET any -> 43.143.206.225 3307 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101010; rev:2;)
alert tcp $HOME_NET any -> 43.143.210.122 3388 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103112; rev:2;)
alert tcp $HOME_NET any -> 43.143.214.85 8089 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103111; rev:2;)
alert tcp $HOME_NET any -> 43.143.214.85 8090 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103110; rev:2;)
alert tls $HOME_NET any -> 43.143.234.164 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"83f9b6f62066807dd3301ec66d112b156978e65e51e7202d9093071c4dc23b09"; reference:url,publicmosaic.com/indicators; sid:9102244; rev:2;)
alert tls $HOME_NET any -> 49.232.21.222 18443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9105018; rev:2;)
alert tcp $HOME_NET any -> 49.232.60.192 4443 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9104201; rev:2;)
alert tls $HOME_NET any -> 49.232.60.192 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"eada92eb116279506de4bccb2a81e49f4cdfb6fa8a942c1788c90d0cb4181685"; reference:url,publicmosaic.com/indicators; sid:9103704; rev:2;)
alert tcp $HOME_NET any -> 49.232.105.96 18888 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103889; rev:2;)
alert tls $HOME_NET any -> 49.232.135.25 443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"6c90ed256aa5b8249f59cfcfe3bff5902780afa2f02f713dcdc3221ab25f2dca"; reference:url,publicmosaic.com/indicators; sid:9100768; rev:2;)
alert tcp $HOME_NET any -> 49.232.135.25 8080 (msg:"HOLLOWPOINT C2 havoc"; reference:url,publicmosaic.com/indicators; sid:9100141; rev:2;)
alert tcp $HOME_NET any -> 49.232.141.174 12345 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104435; rev:2;)
alert tcp $HOME_NET any -> 49.232.166.123 7777 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102989; rev:2;)
alert tcp $HOME_NET any -> 49.232.166.123 8888 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103925; rev:2;)
alert tcp $HOME_NET any -> 49.232.169.67 80 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102988; rev:2;)
alert tcp $HOME_NET any -> 49.232.169.67 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102987; rev:2;)
alert tcp $HOME_NET any -> 49.232.169.67 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102986; rev:2;)
alert tcp $HOME_NET any -> 49.232.169.67 8085 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102985; rev:2;)
alert tls $HOME_NET any -> 49.232.170.10 29180 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"14937c86654dd3165ec87f51387e84c36a0461325661489161326b416a6cafa4"; reference:url,publicmosaic.com/indicators; sid:9100044; rev:2;)
alert tcp $HOME_NET any -> 49.232.183.87 18080 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101575; rev:2;)
alert tcp $HOME_NET any -> 49.232.191.108 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102984; rev:2;)
alert tcp $HOME_NET any -> 49.232.230.9 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102983; rev:2;)
alert tcp $HOME_NET any -> 49.233.13.225 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102982; rev:2;)
alert tcp $HOME_NET any -> 49.233.70.168 1883 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102981; rev:2;)
alert tcp $HOME_NET any -> 49.233.70.168 6379 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105537; rev:2;)
alert tcp $HOME_NET any -> 49.233.192.137 8888 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104056; rev:2;)
alert tcp $HOME_NET any -> 49.233.202.218 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100969; rev:2;)
alert tls $HOME_NET any -> 49.233.202.218 18443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9103467; rev:2;)
alert tcp $HOME_NET any -> 49.234.12.182 4124 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102980; rev:2;)
alert tcp $HOME_NET any -> 49.234.12.182 4321 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102979; rev:2;)
alert tcp $HOME_NET any -> 49.234.28.41 8086 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102978; rev:2;)
alert tcp $HOME_NET any -> 49.234.28.41 8888 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102977; rev:2;)
alert tcp $HOME_NET any -> 49.235.130.208 8523 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105960; rev:2;)
alert tcp $HOME_NET any -> 49.235.130.208 8524 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105959; rev:2;)
alert tls $HOME_NET any -> 49.235.130.208 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9100872; rev:2;)
alert tcp $HOME_NET any -> 49.235.134.179 8888 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105536; rev:2;)
alert tcp $HOME_NET any -> 49.235.172.25 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102976; rev:2;)
alert tcp $HOME_NET any -> 58.87.65.43 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102956; rev:2;)
alert tcp $HOME_NET any -> 58.87.99.193 1234 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105855; rev:2;)
alert tcp $HOME_NET any -> 62.234.17.33 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100967; rev:2;)
alert tcp $HOME_NET any -> 62.234.17.33 13332 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105087; rev:2;)
alert tcp $HOME_NET any -> 62.234.37.129 6767 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102942; rev:2;)
alert tls $HOME_NET any -> 62.234.72.163 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100205; rev:2;)
alert tcp $HOME_NET any -> 62.234.192.69 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102941; rev:2;)
alert tls $HOME_NET any -> 81.68.249.199 1818 (msg:"HOLLOWPOINT C2 quasar_family"; tls.cert_fingerprint; content:"d106993302d81f68c31b1922c27dfde097d2313254eec754f8d6aafafe9bc1ec"; reference:url,publicmosaic.com/indicators; sid:9100036; rev:2;)
alert tcp $HOME_NET any -> 81.69.226.164 12345 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9100131; rev:2;)
alert tcp $HOME_NET any -> 81.70.21.248 8899 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106808; rev:2;)
alert tcp $HOME_NET any -> 81.70.95.138 9096 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105853; rev:2;)
alert tcp $HOME_NET any -> 81.70.95.138 9595 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101005; rev:2;)
alert tcp $HOME_NET any -> 81.70.105.7 4449 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9103373; rev:2;)
alert tcp $HOME_NET any -> 81.70.202.180 8822 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102923; rev:2;)
alert tcp $HOME_NET any -> 81.70.219.240 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9103981; rev:2;)
alert tls $HOME_NET any -> 81.71.7.250 12347 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"2470dda5ded1dd96e9d2afcf6b94628bfb02f444cca0be1528d1f0d9e394dd87"; reference:url,publicmosaic.com/indicators; sid:9105533; rev:2;)
alert tls $HOME_NET any -> 81.71.51.134 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"270f2bb98c1505557c4a2993f8be06a6543ec90ad07d7172acbdb8055aec9e41"; reference:url,publicmosaic.com/indicators; sid:9101296; rev:2;)
alert tcp $HOME_NET any -> 81.71.83.109 18082 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102922; rev:2;)
alert tls $HOME_NET any -> 82.156.80.106 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100035; rev:2;)
alert tcp $HOME_NET any -> 82.156.97.77 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102919; rev:2;)
alert tcp $HOME_NET any -> 82.156.117.56 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102918; rev:2;)
alert tls $HOME_NET any -> 82.156.166.227 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9103966; rev:2;)
alert tls $HOME_NET any -> 82.156.219.31 8443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100005; rev:2;)
alert tls $HOME_NET any -> 82.156.224.184 40056 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"77e6db88c612b5dce6a78c88cf97079746a60158c704a1c799849d7a782eb357"; reference:url,publicmosaic.com/indicators; sid:9103954; rev:2;)
alert tcp $HOME_NET any -> 82.156.243.144 9999 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102917; rev:2;)
alert tcp $HOME_NET any -> 82.157.13.47 8899 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102916; rev:2;)
alert tcp $HOME_NET any -> 82.157.155.59 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106802; rev:2;)
alert tcp $HOME_NET any -> 82.157.174.198 9089 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102915; rev:2;)
alert tcp $HOME_NET any -> 82.157.181.81 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102914; rev:2;)
alert tcp $HOME_NET any -> 82.157.181.81 8894 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102913; rev:2;)
alert tls $HOME_NET any -> 82.157.183.28 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"904ddbde20ba0795aac669f01106a7b4c17cd13309dc196ae3932f531786838c"; reference:url,publicmosaic.com/indicators; sid:9100234; rev:2;)
alert tls $HOME_NET any -> 101.33.200.145 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100213; rev:2;)
alert tls $HOME_NET any -> 101.33.202.134 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"d98e8c33630938fe85a2b8a40947a3fa3c31861532c956a61a26575ac8103352"; reference:url,publicmosaic.com/indicators; sid:9104069; rev:2;)
alert tls $HOME_NET any -> 101.33.202.134 9989 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"d8b7e9e089cc0fc66e988aaaf5cbfcb273cc0d1b9a0adf023210dbfdb0d26cf2"; reference:url,publicmosaic.com/indicators; sid:9102188; rev:2;)
alert tcp $HOME_NET any -> 101.33.225.32 8011 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9100002; rev:2;)
alert tls $HOME_NET any -> 101.33.225.32 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"83581a5ba8722d33dc4ef082961d9575e3cc2ad4acdabc262e7a83b684a79449"; reference:url,publicmosaic.com/indicators; sid:9100001; rev:2;)
alert tcp $HOME_NET any -> 101.34.60.206 38880 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105947; rev:2;)
alert tcp $HOME_NET any -> 101.34.84.27 54321 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102896; rev:2;)
alert tcp $HOME_NET any -> 101.34.218.233 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100953; rev:2;)
alert tcp $HOME_NET any -> 101.34.218.233 8887 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101194; rev:2;)
alert tls $HOME_NET any -> 101.34.222.38 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9102236; rev:2;)
alert tcp $HOME_NET any -> 101.34.223.83 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9103893; rev:2;)
alert tcp $HOME_NET any -> 101.34.246.164 6666 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102895; rev:2;)
alert tcp $HOME_NET any -> 101.35.11.34 10443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102571; rev:2;)
alert tcp $HOME_NET any -> 101.35.79.54 8888 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102570; rev:2;)
alert tcp $HOME_NET any -> 101.35.150.143 9999 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102569; rev:2;)
alert tcp $HOME_NET any -> 101.35.161.46 9089 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102568; rev:2;)
alert tls $HOME_NET any -> 101.35.238.122 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"31a4863751fc8f740499e035d2dfcb96c258a805ee78aeeb65f291bc5d5d0ef7"; reference:url,publicmosaic.com/indicators; sid:9105175; rev:2;)
alert tcp $HOME_NET any -> 101.42.65.25 34566 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103609; rev:2;)
alert tls $HOME_NET any -> 101.42.96.140 8889 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"b5d7a7d4e570aab0baa278c4a576c7b79760b7987a4073d5641580be3e3a8275"; reference:url,publicmosaic.com/indicators; sid:9101942; rev:2;)
alert tls $HOME_NET any -> 101.42.96.140 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"4fcebc1d5407c5c32e3d5b5670e2748ee12db311e6d1d207340e96d04876fcfb"; reference:url,publicmosaic.com/indicators; sid:9100362; rev:2;)
alert tls $HOME_NET any -> 101.42.104.134 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"129ffcef7e1924ab29f85b409d1ce5dd85babf1c84fa8d8b0c1fa4f516e96a22"; reference:url,publicmosaic.com/indicators; sid:9103762; rev:2;)
alert tcp $HOME_NET any -> 101.42.104.134 8767 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105289; rev:2;)
alert tcp $HOME_NET any -> 101.42.104.134 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100491; rev:2;)
alert tcp $HOME_NET any -> 101.42.108.234 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104679; rev:2;)
alert tcp $HOME_NET any -> 101.42.136.73 80 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9101481; rev:2;)
alert tcp $HOME_NET any -> 101.42.136.73 4433 (msg:"HOLLOWPOINT C2 adaptix"; reference:url,publicmosaic.com/indicators; sid:9101529; rev:2;)
alert tls $HOME_NET any -> 101.42.136.73 4488 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"985cd555ff28616638615bbbd5bc826d67d846a61b7b9274bc88b8f2dd4b3721"; reference:url,publicmosaic.com/indicators; sid:9103840; rev:2;)
alert tls $HOME_NET any -> 101.42.136.73 8443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9101480; rev:2;)
alert tcp $HOME_NET any -> 101.42.239.7 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102567; rev:2;)
alert tcp $HOME_NET any -> 101.42.255.92 2234 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9103434; rev:2;)
alert tls $HOME_NET any -> 101.42.255.92 8081 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100762; rev:2;)
alert tcp $HOME_NET any -> 101.43.18.99 8100 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102894; rev:2;)
alert tcp $HOME_NET any -> 101.43.22.71 8899 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102566; rev:2;)
alert tcp $HOME_NET any -> 101.43.22.71 9077 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105948; rev:2;)
alert tcp $HOME_NET any -> 101.43.53.103 6777 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9104847; rev:2;)
alert tcp $HOME_NET any -> 101.43.53.103 8081 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9100188; rev:2;)
alert tcp $HOME_NET any -> 101.43.53.103 9403 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9104259; rev:2;)
alert tls $HOME_NET any -> 101.43.103.154 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"1d89ec9b3ac66180185a5f5e2d71e1a6941301fdf23bf51ce6d642d68e376af0"; reference:url,publicmosaic.com/indicators; sid:9100798; rev:2;)
alert tcp $HOME_NET any -> 101.43.107.222 19001 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102893; rev:2;)
alert tcp $HOME_NET any -> 101.43.107.222 21235 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104016; rev:2;)
alert tcp $HOME_NET any -> 101.43.115.8 7777 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102892; rev:2;)
alert tcp $HOME_NET any -> 101.43.118.48 8888 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101632; rev:2;)
alert tcp $HOME_NET any -> 101.43.128.56 80 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105644; rev:2;)
alert tcp $HOME_NET any -> 101.43.128.56 8080 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105628; rev:2;)
alert tcp $HOME_NET any -> 106.52.91.14 8899 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102514; rev:2;)
alert tcp $HOME_NET any -> 106.52.155.224 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9103894; rev:2;)
alert tcp $HOME_NET any -> 106.52.166.133 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102513; rev:2;)
alert tcp $HOME_NET any -> 106.52.179.216 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9103982; rev:2;)
alert tcp $HOME_NET any -> 106.52.208.143 8085 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102880; rev:2;)
alert tcp $HOME_NET any -> 106.52.238.253 8088 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102512; rev:2;)
alert tcp $HOME_NET any -> 106.52.238.253 55555 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102511; rev:2;)
alert tls $HOME_NET any -> 106.52.255.211 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9102231; rev:2;)
alert tls $HOME_NET any -> 106.53.61.9 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100199; rev:2;)
alert tls $HOME_NET any -> 106.53.107.131 30943 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"7bb7c94b881282bcd804d0d52697a177ef6b6a8cbb5261a0589f4fe01fe4daf1"; reference:url,publicmosaic.com/indicators; sid:9103426; rev:2;)
alert tcp $HOME_NET any -> 106.53.172.234 8123 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105943; rev:2;)
alert tcp $HOME_NET any -> 106.53.172.234 30092 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101341; rev:2;)
alert tls $HOME_NET any -> 106.54.21.74 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9103969; rev:2;)
alert tls $HOME_NET any -> 106.54.41.209 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9100873; rev:2;)
alert tcp $HOME_NET any -> 106.54.44.169 18084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102879; rev:2;)
alert tcp $HOME_NET any -> 106.54.55.251 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102878; rev:2;)
alert tcp $HOME_NET any -> 106.54.59.209 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9103910; rev:2;)
alert tls $HOME_NET any -> 106.54.62.203 80 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"9963b928dc1147cf7ee066e1e98ec9b7365158c06f44a8e326b79ab7c9227ce3"; reference:url,publicmosaic.com/indicators; sid:9100760; rev:2;)
alert tls $HOME_NET any -> 106.54.62.203 65530 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"7d35afdd1f1346397e041507fab20d5bd96d6d6e203711507778f0f40e78f0ad"; reference:url,publicmosaic.com/indicators; sid:9100115; rev:2;)
alert tcp $HOME_NET any -> 106.54.206.77 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9103911; rev:2;)
alert tcp $HOME_NET any -> 106.54.240.229 8484 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104694; rev:2;)
alert tcp $HOME_NET any -> 106.54.241.250 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102877; rev:2;)
alert tcp $HOME_NET any -> 106.54.241.250 33899 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106448; rev:2;)
alert tcp $HOME_NET any -> 106.55.25.39 54321 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102876; rev:2;)
alert tls $HOME_NET any -> 106.55.25.253 8090 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9101528; rev:2;)
alert tls $HOME_NET any -> 106.55.46.152 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9105697; rev:2;)
alert tls $HOME_NET any -> 106.55.47.62 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9105696; rev:2;)
alert tls $HOME_NET any -> 106.55.255.139 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"f20fdf83bcc591cc33b586aa9a80af855be12fce8743ed3df6972d147f4e61b8"; reference:url,publicmosaic.com/indicators; sid:9103374; rev:2;)
alert tls $HOME_NET any -> 110.40.147.249 3333 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"fe62321a1cca3709af6235140036076b014083e751a7a58a00bee67f5e8f8faa"; reference:url,publicmosaic.com/indicators; sid:9104510; rev:2;)
alert tcp $HOME_NET any -> 110.40.147.249 7777 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100494; rev:2;)
alert tcp $HOME_NET any -> 110.40.154.36 8086 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102491; rev:2;)
alert tcp $HOME_NET any -> 110.42.136.5 39003 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102487; rev:2;)
alert tcp $HOME_NET any -> 110.42.211.101 13306 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102874; rev:2;)
alert tcp $HOME_NET any -> 110.42.239.240 15588 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105940; rev:2;)
alert tcp $HOME_NET any -> 110.42.239.240 21481 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104693; rev:2;)
alert tls $HOME_NET any -> 111.229.4.108 2096 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"89db360aff192a136b98a247e5f071a68709f43f0d472d6be6c2982faae49384"; reference:url,publicmosaic.com/indicators; sid:9100420; rev:2;)
alert tcp $HOME_NET any -> 111.229.4.108 8955 (msg:"HOLLOWPOINT C2 quasar_rat"; reference:url,publicmosaic.com/indicators; sid:9106653; rev:2;)
alert tcp $HOME_NET any -> 111.229.135.130 8083 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102873; rev:2;)
alert tcp $HOME_NET any -> 111.229.135.130 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102872; rev:2;)
alert tcp $HOME_NET any -> 111.229.148.135 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106334; rev:2;)
alert tcp $HOME_NET any -> 111.229.153.119 8086 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101189; rev:2;)
alert tcp $HOME_NET any -> 111.229.182.88 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9103926; rev:2;)
alert tcp $HOME_NET any -> 111.229.248.198 80 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9100019; rev:2;)
alert tls $HOME_NET any -> 111.229.248.198 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"e981f151df775275d2f96c564994f0c16b45fa7d5588889f9514e4f7568a3c40"; reference:url,publicmosaic.com/indicators; sid:9105162; rev:2;)
alert tls $HOME_NET any -> 111.230.143.136 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9101342; rev:2;)
alert tcp $HOME_NET any -> 111.230.151.240 5544 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104301; rev:2;)
alert tcp $HOME_NET any -> 111.230.151.240 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104096; rev:2;)
alert tls $HOME_NET any -> 111.231.116.164 4443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9104128; rev:2;)
alert tls $HOME_NET any -> 111.231.116.164 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"2e6ae8fd916ca2c383676b0a0feeaecad1332056689b142fce2275c5e1c7e675"; reference:url,publicmosaic.com/indicators; sid:9105168; rev:2;)
alert tls $HOME_NET any -> 114.132.46.254 8444 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9104182; rev:2;)
alert tcp $HOME_NET any -> 114.132.46.254 8999 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104585; rev:2;)
alert tcp $HOME_NET any -> 114.132.46.254 9001 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102466; rev:2;)
alert tcp $HOME_NET any -> 114.132.46.254 9443 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9104183; rev:2;)
alert tcp $HOME_NET any -> 114.132.178.92 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100956; rev:2;)
alert tls $HOME_NET any -> 114.132.216.210 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9105695; rev:2;)
alert tcp $HOME_NET any -> 114.132.227.102 38584 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106080; rev:2;)
alert tcp $HOME_NET any -> 114.132.227.144 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102465; rev:2;)
alert tcp $HOME_NET any -> 114.132.227.144 37891 (msg:"HOLLOWPOINT C2 quasar_rat"; reference:url,publicmosaic.com/indicators; sid:9106770; rev:2;)
alert tcp $HOME_NET any -> 114.132.251.233 3232 (msg:"HOLLOWPOINT C2 reversessh"; reference:url,publicmosaic.com/indicators; sid:9104461; rev:2;)
alert tcp $HOME_NET any -> 114.132.251.233 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100500; rev:2;)
alert tcp $HOME_NET any -> 115.159.45.186 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102462; rev:2;)
alert tcp $HOME_NET any -> 115.159.72.17 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106606; rev:2;)
alert tcp $HOME_NET any -> 115.159.111.226 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102461; rev:2;)
alert tcp $HOME_NET any -> 115.159.207.153 62119 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104300; rev:2;)
alert tcp $HOME_NET any -> 115.159.210.123 8088 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104584; rev:2;)
alert tcp $HOME_NET any -> 115.159.210.123 10000 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102868; rev:2;)
alert tcp $HOME_NET any -> 115.159.226.190 80 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9100185; rev:2;)
alert tls $HOME_NET any -> 115.159.226.190 54321 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"2a7bbea987b1d5ddd1cff5ce3196c873c6aff882fea8773a3e53c6281167e0c6"; reference:url,publicmosaic.com/indicators; sid:9105468; rev:2;)
alert tcp $HOME_NET any -> 118.24.42.13 5003 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106790; rev:2;)
alert tcp $HOME_NET any -> 118.24.42.13 34551 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106789; rev:2;)
alert tcp $HOME_NET any -> 118.24.42.13 35871 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106788; rev:2;)
alert tls $HOME_NET any -> 118.24.42.214 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100207; rev:2;)
alert tcp $HOME_NET any -> 118.24.172.48 81 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9100184; rev:2;)
alert tcp $HOME_NET any -> 118.25.100.71 5666 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9105826; rev:2;)
alert tls $HOME_NET any -> 118.25.100.71 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"64257fc0fac31c01a5ccd816c73ea86e639260da1604d04db869bb603c2886e6"; reference:url,publicmosaic.com/indicators; sid:9105825; rev:2;)
alert tls $HOME_NET any -> 118.25.103.144 8888 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"8c52b7e4d0dd6952fdb9df975065242f20d86f51bfae45a7c5a5fc2cfef803e2"; reference:url,publicmosaic.com/indicators; sid:9100824; rev:2;)
alert tcp $HOME_NET any -> 118.25.179.125 50001 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104675; rev:2;)
alert tls $HOME_NET any -> 118.25.188.245 4782 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"dc2f5830ef7a7aa316b710e05805b169767edb0ada1fd91bb3969f51e19c2e9f"; reference:url,publicmosaic.com/indicators; sid:9100110; rev:2;)
alert tcp $HOME_NET any -> 118.25.192.79 16379 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104572; rev:2;)
alert tcp $HOME_NET any -> 118.89.79.131 6528 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9103430; rev:2;)
alert tls $HOME_NET any -> 118.89.79.131 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"5222d6b53b3d9e67aa5acd3ce944951ef75c02cafafa212462e27b04dd8fec31"; reference:url,publicmosaic.com/indicators; sid:9100021; rev:2;)
alert tcp $HOME_NET any -> 118.89.88.183 56781 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9103444; rev:2;)
alert tcp $HOME_NET any -> 118.89.88.183 58086 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105531; rev:2;)
alert tcp $HOME_NET any -> 118.89.124.88 8080 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100954; rev:2;)
alert tcp $HOME_NET any -> 118.89.124.88 8089 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101216; rev:2;)
alert tls $HOME_NET any -> 118.126.97.69 4782 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"0927c841093700593445f3b78da0094f1c0508368eb2d2eb7180d2c2a079e2c0"; reference:url,publicmosaic.com/indicators; sid:9102257; rev:2;)
alert tcp $HOME_NET any -> 118.126.103.206 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104203; rev:2;)
alert tcp $HOME_NET any -> 118.126.104.234 20001 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104571; rev:2;)
alert tls $HOME_NET any -> 118.195.130.210 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"757d4b38e1e0d1863b66d197afe9e7308c1ac1d2050563b027f7c7a938c4fc3f"; reference:url,publicmosaic.com/indicators; sid:9102285; rev:2;)
alert tcp $HOME_NET any -> 118.195.158.209 8083 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102866; rev:2;)
alert tls $HOME_NET any -> 118.195.163.227 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"d55457fe50519b02116dde7cd761ba5f327b5f05a374920c4b857115f3233682"; reference:url,publicmosaic.com/indicators; sid:9106800; rev:2;)
alert tls $HOME_NET any -> 118.195.163.227 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"85c5ffffa0ad280a809caefe6e294eec6bb29b5fb27b964c9b722d898ab75b9b"; reference:url,publicmosaic.com/indicators; sid:9106817; rev:2;)
alert tcp $HOME_NET any -> 118.195.195.187 8787 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102865; rev:2;)
alert tcp $HOME_NET any -> 119.29.139.137 4445 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104570; rev:2;)
alert tcp $HOME_NET any -> 119.45.23.116 4433 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102864; rev:2;)
alert tcp $HOME_NET any -> 119.45.23.116 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102863; rev:2;)
alert tcp $HOME_NET any -> 119.45.28.237 8081 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105330; rev:2;)
alert tls $HOME_NET any -> 119.45.93.117 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"5e02bbdbd098874812f987e6c1b96e11f01a8d57a4a3e10a9f625fa097d11122"; reference:url,publicmosaic.com/indicators; sid:9101258; rev:2;)
alert tcp $HOME_NET any -> 119.45.102.168 61263 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103809; rev:2;)
alert tls $HOME_NET any -> 119.45.105.71 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"b083bad4967a9af4814c0b0f14c539a04b4978b85b1b8ecdd02ed8f4cc634d9c"; reference:url,publicmosaic.com/indicators; sid:9105292; rev:2;)
alert tcp $HOME_NET any -> 119.45.105.71 8081 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102862; rev:2;)
alert tcp $HOME_NET any -> 119.45.105.71 8088 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102861; rev:2;)
alert tcp $HOME_NET any -> 119.45.105.71 8089 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102860; rev:2;)
alert tcp $HOME_NET any -> 119.45.122.80 6398 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104966; rev:2;)
alert tcp $HOME_NET any -> 119.45.151.252 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104095; rev:2;)
alert tcp $HOME_NET any -> 119.45.160.160 80 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9100009; rev:2;)
alert tls $HOME_NET any -> 119.45.160.160 8889 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100200; rev:2;)
alert tcp $HOME_NET any -> 119.45.160.160 18089 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104569; rev:2;)
alert tls $HOME_NET any -> 119.45.160.160 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"de92cc976b7815a39df9039b130a51a7472df49ff0111c9d4c0c62209664e573"; reference:url,publicmosaic.com/indicators; sid:9100008; rev:2;)
alert tls $HOME_NET any -> 119.45.190.210 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"6c126ef9e9a06807edd39d5315e8ea87dacb51a03eafaea0c9c7a0f01c6afbb2"; reference:url,publicmosaic.com/indicators; sid:9102284; rev:2;)
alert tcp $HOME_NET any -> 119.45.190.210 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100485; rev:2;)
alert tcp $HOME_NET any -> 119.45.224.18 8087 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101187; rev:2;)
alert tls $HOME_NET any -> 119.45.225.53 8888 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100823; rev:2;)
alert tls $HOME_NET any -> 119.45.225.53 8889 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100700; rev:2;)
alert tcp $HOME_NET any -> 119.45.231.164 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101221; rev:2;)
alert tcp $HOME_NET any -> 119.45.231.164 6666 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101882; rev:2;)
alert tcp $HOME_NET any -> 119.91.32.43 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102438; rev:2;)
alert tcp $HOME_NET any -> 119.91.49.9 9876 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101217; rev:2;)
alert tcp $HOME_NET any -> 119.91.138.64 4433 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102437; rev:2;)
alert tcp $HOME_NET any -> 119.91.138.64 4455 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102436; rev:2;)
alert tcp $HOME_NET any -> 119.91.140.188 8085 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104568; rev:2;)
alert tls $HOME_NET any -> 119.91.246.156 8989 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"3888138f6de064adf3f617d7a5edd7bc9646fd2c866af1b4d6e96b178a9f33d6"; reference:url,publicmosaic.com/indicators; sid:9103369; rev:2;)
alert tls $HOME_NET any -> 120.53.238.38 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100204; rev:2;)
alert tls $HOME_NET any -> 121.4.38.18 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100274; rev:2;)
alert tcp $HOME_NET any -> 121.4.43.2 8830 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104297; rev:2;)
alert tls $HOME_NET any -> 121.4.43.2 8888 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"dd005ea709c75822e093fb3cd798dbf035e8f7638a7d80c942e092ae11188392"; reference:url,publicmosaic.com/indicators; sid:9104962; rev:2;)
alert tls $HOME_NET any -> 121.4.43.2 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"7b522da120daf13983e4f8456a0f9a715515fa3bf6de50c42aa8033670045a5a"; reference:url,publicmosaic.com/indicators; sid:9104115; rev:2;)
alert tcp $HOME_NET any -> 121.4.44.152 58888 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102859; rev:2;)
alert tcp $HOME_NET any -> 121.4.92.72 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102858; rev:2;)
alert tls $HOME_NET any -> 122.51.16.188 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c376478"; reference:url,publicmosaic.com/indicators; sid:9100721; rev:2;)
alert tcp $HOME_NET any -> 122.51.31.224 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104566; rev:2;)
alert tcp $HOME_NET any -> 122.51.48.49 8086 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105931; rev:2;)
alert tcp $HOME_NET any -> 122.51.118.220 61616 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105932; rev:2;)
alert tcp $HOME_NET any -> 122.51.155.216 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104014; rev:2;)
alert tls $HOME_NET any -> 122.51.215.90 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9102228; rev:2;)
alert tcp $HOME_NET any -> 122.51.247.79 8080 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102857; rev:2;)
alert tcp $HOME_NET any -> 122.152.196.122 4433 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105086; rev:2;)
alert tcp $HOME_NET any -> 123.207.198.218 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9103892; rev:2;)
alert tcp $HOME_NET any -> 123.207.203.20 44512 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102852; rev:2;)
alert tcp $HOME_NET any -> 123.207.203.20 44513 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102851; rev:2;)
alert tcp $HOME_NET any -> 123.207.214.140 6312 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9103441; rev:2;)
alert tcp $HOME_NET any -> 123.207.214.140 6313 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9104840; rev:2;)
alert tcp $HOME_NET any -> 123.207.214.140 6316 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9103440; rev:2;)
alert tcp $HOME_NET any -> 123.207.250.107 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102417; rev:2;)
alert tcp $HOME_NET any -> 124.220.0.201 7777 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101185; rev:2;)
alert tcp $HOME_NET any -> 124.220.11.206 2550 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102850; rev:2;)
alert tcp $HOME_NET any -> 124.220.11.206 8888 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102849; rev:2;)
alert tls $HOME_NET any -> 124.220.16.198 8888 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"b342a79baba091455e044db5575196c6df606e5f5b6cea1e27e8c7934e418ed9"; reference:url,publicmosaic.com/indicators; sid:9103956; rev:2;)
alert tcp $HOME_NET any -> 124.220.25.149 6379 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102414; rev:2;)
alert tcp $HOME_NET any -> 124.220.34.180 6666 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9100272; rev:2;)
alert tcp $HOME_NET any -> 124.220.35.242 50443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102848; rev:2;)
alert tcp $HOME_NET any -> 124.220.49.140 8000 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9103818; rev:2;)
alert tls $HOME_NET any -> 124.220.55.95 23333 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"a19ea9e0f98ad7222d21cab2ab539730ed7e2c9f4005f43bc5ea3f7ea1604996"; reference:url,publicmosaic.com/indicators; sid:9103779; rev:2;)
alert tcp $HOME_NET any -> 124.220.55.115 1224 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105930; rev:2;)
alert tcp $HOME_NET any -> 124.220.59.145 4554 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9103443; rev:2;)
alert tls $HOME_NET any -> 124.220.59.145 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"3bb792cfe4157602990f6c7005005eb2dd36985887a48d926e723a4c00ec40d6"; reference:url,publicmosaic.com/indicators; sid:9105193; rev:2;)
alert tcp $HOME_NET any -> 124.220.74.46 1227 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106331; rev:2;)
alert tcp $HOME_NET any -> 124.220.74.46 1337 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102413; rev:2;)
alert tcp $HOME_NET any -> 124.220.74.46 9527 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104565; rev:2;)
alert tcp $HOME_NET any -> 124.220.74.46 55555 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102412; rev:2;)
alert tls $HOME_NET any -> 124.220.161.214 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9102227; rev:2;)
alert tcp $HOME_NET any -> 124.220.212.113 59001 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104564; rev:2;)
alert tcp $HOME_NET any -> 124.221.1.207 7788 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106602; rev:2;)
alert tcp $HOME_NET any -> 124.221.1.207 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105848; rev:2;)
alert tcp $HOME_NET any -> 124.221.46.243 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100941; rev:2;)
alert tcp $HOME_NET any -> 124.221.47.107 80 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9100179; rev:2;)
alert tcp $HOME_NET any -> 124.221.92.3 9922 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102411; rev:2;)
alert tcp $HOME_NET any -> 124.221.123.163 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9103927; rev:2;)
alert tcp $HOME_NET any -> 124.221.141.62 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102410; rev:2;)
alert tcp $HOME_NET any -> 124.221.175.211 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102847; rev:2;)
alert tcp $HOME_NET any -> 124.221.175.211 8088 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102846; rev:2;)
alert tcp $HOME_NET any -> 124.221.190.127 8786 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9103439; rev:2;)
alert tcp $HOME_NET any -> 124.221.191.237 4521 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9105015; rev:2;)
alert tcp $HOME_NET any -> 124.221.195.107 81 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102845; rev:2;)
alert tcp $HOME_NET any -> 124.221.195.107 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102844; rev:2;)
alert tls $HOME_NET any -> 124.221.215.82 40056 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"b9942d1fe1b0e462194b835b46d959a0c6b00844c604b32ee114c965afa1c32e"; reference:url,publicmosaic.com/indicators; sid:9100747; rev:2;)
alert tls $HOME_NET any -> 124.221.221.58 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"9c29af7d072b473b31d02e6b303e2a477c18d6c6db8abf590c18762bbbdf8be0"; reference:url,publicmosaic.com/indicators; sid:9102283; rev:2;)
alert tcp $HOME_NET any -> 124.221.221.58 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100479; rev:2;)
alert tcp $HOME_NET any -> 124.221.221.58 27001 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101986; rev:2;)
alert tcp $HOME_NET any -> 124.221.221.58 27002 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101985; rev:2;)
alert tls $HOME_NET any -> 124.222.28.189 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"260adc9c616bf84d13019a0e3e51ba83464461df35b014ce516cd9789b864a49"; reference:url,publicmosaic.com/indicators; sid:9100229; rev:2;)
alert tcp $HOME_NET any -> 124.222.28.189 54325 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9106773; rev:2;)
alert tcp $HOME_NET any -> 124.222.37.250 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104563; rev:2;)
alert tls $HOME_NET any -> 124.222.57.34 8081 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c376478"; reference:url,publicmosaic.com/indicators; sid:9102409; rev:2;)
alert tcp $HOME_NET any -> 124.222.57.34 9998 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104562; rev:2;)
alert tcp $HOME_NET any -> 124.222.57.34 9999 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101478; rev:2;)
alert tcp $HOME_NET any -> 124.222.69.132 8085 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104561; rev:2;)
alert tcp $HOME_NET any -> 124.222.73.168 8844 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104667; rev:2;)
alert tcp $HOME_NET any -> 124.222.73.168 9090 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104666; rev:2;)
alert tcp $HOME_NET any -> 124.222.79.201 61000 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104560; rev:2;)
alert tcp $HOME_NET any -> 124.222.85.19 8088 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102408; rev:2;)
alert tcp $HOME_NET any -> 124.222.99.196 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104665; rev:2;)
alert tcp $HOME_NET any -> 124.222.104.163 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105847; rev:2;)
alert tcp $HOME_NET any -> 124.222.128.197 4472 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104559; rev:2;)
alert tcp $HOME_NET any -> 124.222.128.197 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104558; rev:2;)
alert tcp $HOME_NET any -> 124.222.141.204 8085 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102843; rev:2;)
alert tls $HOME_NET any -> 124.222.144.44 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"bb27311392242ae1cce1f0f39a4547379db63a6843a74ecbbc8ca9f0d3b373cb"; reference:url,publicmosaic.com/indicators; sid:9100347; rev:2;)
alert tcp $HOME_NET any -> 124.222.144.44 63321 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102407; rev:2;)
alert tls $HOME_NET any -> 124.222.145.172 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"9c981e57dc1ec3b131ad366cb51bc9c1db73e158eb7aa5860f19e181c5dca571"; reference:url,publicmosaic.com/indicators; sid:9100016; rev:2;)
alert tcp $HOME_NET any -> 124.222.147.241 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106330; rev:2;)
alert tcp $HOME_NET any -> 124.222.150.13 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100950; rev:2;)
alert tcp $HOME_NET any -> 124.222.161.70 52956 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9103431; rev:2;)
alert tls $HOME_NET any -> 124.222.209.39 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c376478"; reference:url,publicmosaic.com/indicators; sid:9100228; rev:2;)
alert tcp $HOME_NET any -> 124.222.210.55 9831 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104664; rev:2;)
alert tcp $HOME_NET any -> 124.222.210.55 32768 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9102406; rev:2;)
alert tcp $HOME_NET any -> 124.222.210.55 59100 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102405; rev:2;)
alert tcp $HOME_NET any -> 124.222.229.235 58085 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104557; rev:2;)
alert tcp $HOME_NET any -> 124.222.229.235 58320 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104556; rev:2;)
alert tcp $HOME_NET any -> 124.223.113.245 5432 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104555; rev:2;)
alert tcp $HOME_NET any -> 124.223.113.245 33389 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105929; rev:2;)
alert tcp $HOME_NET any -> 124.223.156.196 80 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102404; rev:2;)
alert tcp $HOME_NET any -> 124.223.188.23 1234 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9105827; rev:2;)
alert tls $HOME_NET any -> 124.223.188.23 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"aca8601895a068648319a12cf0b5a0b705b1a577c231dfe8c73f9576ee667f9f"; reference:url,publicmosaic.com/indicators; sid:9105164; rev:2;)
alert tcp $HOME_NET any -> 124.223.193.202 1234 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102403; rev:2;)
alert tcp $HOME_NET any -> 124.223.196.227 58084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102402; rev:2;)
alert tcp $HOME_NET any -> 124.223.198.8 50002 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102401; rev:2;)
alert tcp $HOME_NET any -> 124.223.200.92 18443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104554; rev:2;)
alert tcp $HOME_NET any -> 124.223.209.153 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106601; rev:2;)
alert tcp $HOME_NET any -> 124.223.221.83 6666 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101184; rev:2;)
alert tcp $HOME_NET any -> 129.28.44.165 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104013; rev:2;)
alert tls $HOME_NET any -> 129.28.122.92 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100202; rev:2;)
alert tcp $HOME_NET any -> 129.28.125.175 80 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100939; rev:2;)
alert tcp $HOME_NET any -> 129.28.125.175 8080 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100944; rev:2;)
alert tcp $HOME_NET any -> 129.28.125.175 13306 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102399; rev:2;)
alert tcp $HOME_NET any -> 129.204.10.223 8028 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101182; rev:2;)
alert tcp $HOME_NET any -> 129.204.196.251 2222 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106787; rev:2;)
alert tcp $HOME_NET any -> 129.211.11.213 8888 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9103948; rev:2;)
alert tcp $HOME_NET any -> 129.211.168.165 80 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100945; rev:2;)
alert tcp $HOME_NET any -> 129.211.168.165 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100946; rev:2;)
alert tcp $HOME_NET any -> 132.232.245.164 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102392; rev:2;)
alert tcp $HOME_NET any -> 134.175.86.167 21111 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104550; rev:2;)
alert tls $HOME_NET any -> 134.175.87.25 4782 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"dc2f5830ef7a7aa316b710e05805b169767edb0ada1fd91bb3969f51e19c2e9f"; reference:url,publicmosaic.com/indicators; sid:9102256; rev:2;)
alert tcp $HOME_NET any -> 139.155.42.198 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102387; rev:2;)
alert tcp $HOME_NET any -> 139.155.138.221 60001 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103808; rev:2;)
alert tcp $HOME_NET any -> 139.155.148.102 13389 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102386; rev:2;)
alert tcp $HOME_NET any -> 139.199.18.159 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103807; rev:2;)
alert tcp $HOME_NET any -> 139.199.80.221 8016 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104925; rev:2;)
alert tcp $HOME_NET any -> 139.199.80.221 8443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106170; rev:2;)
alert tls $HOME_NET any -> 139.199.160.80 32408 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"3888138f6de064adf3f617d7a5edd7bc9646fd2c866af1b4d6e96b178a9f33d6"; reference:url,publicmosaic.com/indicators; sid:9103366; rev:2;)
alert tcp $HOME_NET any -> 140.143.87.68 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104659; rev:2;)
alert tcp $HOME_NET any -> 140.143.87.68 9443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104658; rev:2;)
alert tls $HOME_NET any -> 140.143.130.157 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"2a029da6e6e5288fb7230da0d2701bbbd8ec4faa04bf6109c262cd75832e164f"; reference:url,publicmosaic.com/indicators; sid:9103761; rev:2;)
alert tcp $HOME_NET any -> 140.143.130.157 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100477; rev:2;)
alert tcp $HOME_NET any -> 146.56.204.18 8024 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105327; rev:2;)
alert tls $HOME_NET any -> 146.56.214.130 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"5017255d7a8409408aabc049045b5bb210dfe5f79c8fc31e3c2fd93097c7b056"; reference:url,publicmosaic.com/indicators; sid:9100334; rev:2;)
alert tcp $HOME_NET any -> 146.56.239.16 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101625; rev:2;)
alert tcp $HOME_NET any -> 150.158.27.4 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102839; rev:2;)
alert tcp $HOME_NET any -> 150.158.30.251 18084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102838; rev:2;)
alert tcp $HOME_NET any -> 150.158.30.251 18089 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102837; rev:2;)
alert tcp $HOME_NET any -> 150.158.86.86 10089 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102180; rev:2;)
alert tcp $HOME_NET any -> 150.158.102.111 85 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9101477; rev:2;)
alert tls $HOME_NET any -> 150.158.102.111 1235 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9102808; rev:2;)
alert tls $HOME_NET any -> 150.158.102.111 5005 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c376478"; reference:url,publicmosaic.com/indicators; sid:9102807; rev:2;)
alert tcp $HOME_NET any -> 150.158.102.111 8049 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102836; rev:2;)
alert tcp $HOME_NET any -> 150.158.102.111 8050 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102835; rev:2;)
alert tls $HOME_NET any -> 150.158.122.8 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"7d46f1eddf42dd1d50746f8bfce23096a606e91f6c5511d93a7f078450fb4804"; reference:url,publicmosaic.com/indicators; sid:9100328; rev:2;)
alert tcp $HOME_NET any -> 152.136.38.231 20002 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102348; rev:2;)
alert tcp $HOME_NET any -> 152.136.38.231 20003 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102347; rev:2;)
alert tcp $HOME_NET any -> 152.136.38.231 20004 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102346; rev:2;)
alert tcp $HOME_NET any -> 152.136.38.231 20005 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102345; rev:2;)
alert tls $HOME_NET any -> 152.136.56.105 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"87b762d04a1794a7df42e8b1500598ecf095eaf3a512303c93909cb64893b5ca"; reference:url,publicmosaic.com/indicators; sid:9104451; rev:2;)
alert tcp $HOME_NET any -> 152.136.56.105 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9104507; rev:2;)
alert tcp $HOME_NET any -> 152.136.200.205 43691 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102344; rev:2;)
alert tcp $HOME_NET any -> 152.136.253.101 4444 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9104261; rev:2;)
alert tcp $HOME_NET any -> 152.136.253.101 8080 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9106191; rev:2;)
alert tcp $HOME_NET any -> 152.136.253.101 8888 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9106423; rev:2;)
alert tls $HOME_NET any -> 152.136.253.101 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"4b63b8f6c095f1a064d1722f591dbe89027101bcfc6aa982e4cc22a92a22d9f7"; reference:url,publicmosaic.com/indicators; sid:9104845; rev:2;)
alert tcp $HOME_NET any -> 154.8.136.171 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103296; rev:2;)
alert tcp $HOME_NET any -> 154.8.155.90 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106600; rev:2;)
alert tcp $HOME_NET any -> 159.75.118.45 9090 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102714; rev:2;)
alert tcp $HOME_NET any -> 159.75.123.199 1111 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9101953; rev:2;)
alert tls $HOME_NET any -> 159.75.123.199 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"7ab5234af0080bc02d0f398a42905ecc9a81c6f01c3c64f196a2383cbe331b4c"; reference:url,publicmosaic.com/indicators; sid:9100015; rev:2;)
alert tcp $HOME_NET any -> 159.75.135.128 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102713; rev:2;)
alert tcp $HOME_NET any -> 159.75.158.207 8087 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102712; rev:2;)
alert tcp $HOME_NET any -> 159.75.158.207 18087 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102711; rev:2;)
alert tcp $HOME_NET any -> 159.75.158.207 28287 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102710; rev:2;)
alert tcp $HOME_NET any -> 162.14.99.178 61080 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102707; rev:2;)
alert tcp $HOME_NET any -> 162.14.116.65 18084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102706; rev:2;)
alert tcp $HOME_NET any -> 162.14.124.25 443 (msg:"HOLLOWPOINT C2 adaptix"; reference:url,publicmosaic.com/indicators; sid:9100643; rev:2;)
alert tls $HOME_NET any -> 162.14.124.25 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"e580e149b5b2307ec5ca3b694c95bbdd02b696e3fab1b7ced19ad1e7c1bc7bb1"; reference:url,publicmosaic.com/indicators; sid:9100459; rev:2;)
alert tcp $HOME_NET any -> 162.14.150.23 8011 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9104839; rev:2;)
alert tcp $HOME_NET any -> 175.27.140.230 8888 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102696; rev:2;)
alert tcp $HOME_NET any -> 175.27.164.199 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104922; rev:2;)
alert tls $HOME_NET any -> 175.27.214.144 4433 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100699; rev:2;)
alert tls $HOME_NET any -> 175.27.214.144 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c376478"; reference:url,publicmosaic.com/indicators; sid:9100719; rev:2;)
alert tcp $HOME_NET any -> 175.178.12.127 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102695; rev:2;)
alert tcp $HOME_NET any -> 175.178.24.97 7890 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102694; rev:2;)
alert tls $HOME_NET any -> 175.178.230.164 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100198; rev:2;)
alert tcp $HOME_NET any -> 182.254.146.29 55555 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102674; rev:2;)
alert tcp $HOME_NET any -> 182.254.162.240 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103815; rev:2;)
alert tcp $HOME_NET any -> 192.144.156.56 56789 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102657; rev:2;)
alert tcp $HOME_NET any -> 192.144.168.105 9999 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101623; rev:2;)
alert tls $HOME_NET any -> 192.144.171.134 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100257; rev:2;)
alert tls $HOME_NET any -> 192.144.211.249 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9102222; rev:2;)
alert tcp $HOME_NET any -> 192.144.219.65 5656 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9104121; rev:2;)
alert tcp $HOME_NET any -> 192.144.219.65 8089 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102656; rev:2;)
alert tcp $HOME_NET any -> 192.144.219.65 8099 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104606; rev:2;)
alert tcp $HOME_NET any -> 193.112.28.215 1443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102650; rev:2;)
alert tcp $HOME_NET any -> 193.112.28.215 8989 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104006; rev:2;)
alert tcp $HOME_NET any -> 193.112.28.215 9898 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102649; rev:2;)
alert tcp $HOME_NET any -> 193.112.28.215 15443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101207; rev:2;)
alert tcp $HOME_NET any -> 193.112.28.215 18090 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105470; rev:2;)
alert tls $HOME_NET any -> 193.112.169.214 30727 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"380197285f0e1f1df6336a0e4eaa7648c9f7d4b467b0d36c0cd3def0ba5030a9"; reference:url,publicmosaic.com/indicators; sid:9103356; rev:2;)
alert tcp $HOME_NET any -> 193.112.172.196 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102648; rev:2;)
alert tls $HOME_NET any -> 193.112.176.26 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"7c6eb2eac8bfbffc0354e6808fb89df23435713a325db5d5f554925a020f7a06"; reference:url,publicmosaic.com/indicators; sid:9105794; rev:2;)
alert tls $HOME_NET any -> 193.112.191.222 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100197; rev:2;)
alert tcp $HOME_NET any -> 193.112.200.118 8003 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105869; rev:2;)
alert tls $HOME_NET any -> 193.112.254.32 8989 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"380197285f0e1f1df6336a0e4eaa7648c9f7d4b467b0d36c0cd3def0ba5030a9"; reference:url,publicmosaic.com/indicators; sid:9103355; rev:2;)
alert tls $HOME_NET any -> 203.195.217.161 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9102221; rev:2;)
alert tcp $HOME_NET any -> 211.159.178.25 8888 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105672; rev:2;)