# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 132 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: asn 45102 — https://publicmosaic.com/asn/45102
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 4
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tls $HOME_NET any -> 8.210.120.225 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"f3dd3687e726cc58a6cbdb45922e058519bfab98e005211da39978726d414582"; reference:url,publicmosaic.com/indicators; sid:9102018; rev:2;)
alert tcp $HOME_NET any -> 8.210.131.228 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103250; rev:2;)
alert tls $HOME_NET any -> 8.210.146.82 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"64a6f180b43e32e16a11368ce4319cc4e7002dbc16c8273cdd5051c4e6f0cd92"; reference:url,publicmosaic.com/indicators; sid:9104231; rev:2;)
alert tcp $HOME_NET any -> 8.210.146.82 18888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100510; rev:2;)
alert tcp $HOME_NET any -> 8.210.222.251 56789 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103622; rev:2;)
alert tcp $HOME_NET any -> 8.210.248.241 8088 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104479; rev:2;)
alert tcp $HOME_NET any -> 8.210.253.7 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105632; rev:2;)
alert tcp $HOME_NET any -> 8.211.146.92 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9100998; rev:2;)
alert tcp $HOME_NET any -> 8.211.194.92 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104478; rev:2;)
alert tls $HOME_NET any -> 8.211.194.92 41076 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"95f72643009c1d4c8d2fe29be7702620f5e252a54f76dff855c52c2712003e68"; reference:url,publicmosaic.com/indicators; sid:9100038; rev:2;)
alert tcp $HOME_NET any -> 8.213.149.0 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106614; rev:2;)
alert tcp $HOME_NET any -> 8.216.20.25 4433 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104442; rev:2;)
alert tcp $HOME_NET any -> 8.217.34.108 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104832; rev:2;)
alert tcp $HOME_NET any -> 8.218.4.6 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103249; rev:2;)
alert tcp $HOME_NET any -> 8.218.4.6 60001 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105854; rev:2;)
alert tcp $HOME_NET any -> 8.218.82.170 18090 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103248; rev:2;)
alert tcp $HOME_NET any -> 8.218.114.253 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103247; rev:2;)
alert tcp $HOME_NET any -> 8.218.114.253 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103246; rev:2;)
alert tcp $HOME_NET any -> 8.218.114.253 5900 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103245; rev:2;)
alert tcp $HOME_NET any -> 8.218.114.253 8443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103244; rev:2;)
alert tcp $HOME_NET any -> 8.218.114.253 35000 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103243; rev:2;)
alert tcp $HOME_NET any -> 8.218.114.253 39000 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103242; rev:2;)
alert tcp $HOME_NET any -> 8.218.114.253 45000 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103241; rev:2;)
alert tcp $HOME_NET any -> 8.218.114.253 53000 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103240; rev:2;)
alert tcp $HOME_NET any -> 8.218.114.253 59000 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103239; rev:2;)
alert tls $HOME_NET any -> 8.218.120.126 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"e2cf93dc4d6b36ed574dcbc2e28386e620335d1ccea3f13ba963b68d3ace2a44"; reference:url,publicmosaic.com/indicators; sid:9103763; rev:2;)
alert tcp $HOME_NET any -> 8.218.120.126 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100497; rev:2;)
alert tls $HOME_NET any -> 8.218.138.77 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"0cd0aa30838af145947e53d0507f1b151a4a6a6037b5009f2f7a2b3aed7fde56"; reference:url,publicmosaic.com/indicators; sid:9104158; rev:2;)
alert tcp $HOME_NET any -> 8.218.138.77 8081 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103238; rev:2;)
alert tcp $HOME_NET any -> 8.218.138.77 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100489; rev:2;)
alert tls $HOME_NET any -> 8.218.231.53 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"a2a9157ea8d65d1b95690b39ce5698754fbbfb1eba3aa0a8b973f704479f6f9c"; reference:url,publicmosaic.com/indicators; sid:9102017; rev:2;)
alert tcp $HOME_NET any -> 8.219.90.249 8443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103237; rev:2;)
alert tcp $HOME_NET any -> 8.219.90.249 8848 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103236; rev:2;)
alert tls $HOME_NET any -> 8.219.149.222 8080 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"98c0a69bfd1583449e3dd71bbb451ff0ae9b9d5b57104a8b4512eda9416322cb"; reference:url,publicmosaic.com/indicators; sid:9101916; rev:2;)
alert tls $HOME_NET any -> 8.219.149.222 8443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"82f36ce027070c7d0c70144461ae17f5f4fce10b0f25b03669d6ee20c99a0dba"; reference:url,publicmosaic.com/indicators; sid:9104466; rev:2;)
alert tls $HOME_NET any -> 8.219.149.222 8888 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"82f36ce027070c7d0c70144461ae17f5f4fce10b0f25b03669d6ee20c99a0dba"; reference:url,publicmosaic.com/indicators; sid:9104465; rev:2;)
alert tls $HOME_NET any -> 8.219.149.222 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"7413f48ab9a204cdd2e79cb84746c02f1907a85a0701cf8281218f2e90e90685"; reference:url,publicmosaic.com/indicators; sid:9100410; rev:2;)
alert tcp $HOME_NET any -> 8.219.154.237 44321 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105094; rev:2;)
alert tcp $HOME_NET any -> 8.219.208.193 60001 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103235; rev:2;)
alert tcp $HOME_NET any -> 8.219.208.193 60002 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103234; rev:2;)
alert tcp $HOME_NET any -> 8.219.211.139 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105629; rev:2;)
alert tcp $HOME_NET any -> 8.219.211.139 8888 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105662; rev:2;)
alert tls $HOME_NET any -> 8.219.220.240 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100254; rev:2;)
alert tls $HOME_NET any -> 8.219.220.240 7443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100220; rev:2;)
alert tcp $HOME_NET any -> 8.220.246.195 8443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104477; rev:2;)
alert tls $HOME_NET any -> 8.221.103.101 443 (msg:"HOLLOWPOINT exposed tool ligolo"; tls.cert_fingerprint; content:"a76ac0185fa8ce94ba6162d1f0b94b027ea571a31652609e963a0a40a588f2ea"; reference:url,publicmosaic.com/indicators; sid:9101700; rev:2;)
alert tls $HOME_NET any -> 8.222.147.42 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"ec0d57d9410b5f7c6d0dc6f49fd99c6eebcab21e8fa1f087ee3f6e254a5e30c6"; reference:url,publicmosaic.com/indicators; sid:9105174; rev:2;)
alert tls $HOME_NET any -> 8.222.188.173 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100208; rev:2;)
alert tcp $HOME_NET any -> 8.222.217.251 8443 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9103674; rev:2;)
alert tls $HOME_NET any -> 43.98.165.114 443 (msg:"HOLLOWPOINT C2 darksword"; tls.cert_fingerprint; content:"fb5c28e93171fb1abde70a325101b1d8fdcf13e4892ada51042fabcb4f02bb71"; reference:url,publicmosaic.com/indicators; sid:9105964; rev:2;)
alert tcp $HOME_NET any -> 43.98.252.110 8443 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9103673; rev:2;)
alert tcp $HOME_NET any -> 43.106.28.184 44321 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105089; rev:2;)
alert tls $HOME_NET any -> 43.108.51.124 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"a0893daff71993c0dbd95e0294d50f758174e313689b4ce233a3d49368f76891"; reference:url,publicmosaic.com/indicators; sid:9100026; rev:2;)
alert tls $HOME_NET any -> 43.108.51.124 10001 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"d450a4057ac6e8bf23eb61933ef1edd5ed073395e6e17adb12ef0918193cc645"; reference:url,publicmosaic.com/indicators; sid:9105198; rev:2;)
alert tcp $HOME_NET any -> 43.108.57.27 3000 (msg:"HOLLOWPOINT C2 darksword"; reference:url,publicmosaic.com/indicators; sid:9105966; rev:2;)
alert tcp $HOME_NET any -> 43.110.42.102 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103136; rev:2;)
alert tcp $HOME_NET any -> 43.110.42.102 81 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103135; rev:2;)
alert tcp $HOME_NET any -> 43.110.54.62 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103645; rev:2;)
alert tcp $HOME_NET any -> 43.111.235.219 80 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103134; rev:2;)
alert tcp $HOME_NET any -> 43.111.235.219 16667 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103133; rev:2;)
alert tcp $HOME_NET any -> 47.74.43.122 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103812; rev:2;)
alert tcp $HOME_NET any -> 47.74.242.253 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9105147; rev:2;)
alert tcp $HOME_NET any -> 47.76.37.50 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103056; rev:2;)
alert tcp $HOME_NET any -> 47.76.245.121 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103055; rev:2;)
alert tcp $HOME_NET any -> 47.76.252.195 10033 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105539; rev:2;)
alert tls $HOME_NET any -> 47.79.21.106 45678 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100043; rev:2;)
alert tcp $HOME_NET any -> 47.79.123.84 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103054; rev:2;)
alert tcp $HOME_NET any -> 47.79.123.84 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103053; rev:2;)
alert tcp $HOME_NET any -> 47.80.57.141 8888 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103052; rev:2;)
alert tcp $HOME_NET any -> 47.80.57.141 8889 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103051; rev:2;)
alert tls $HOME_NET any -> 47.82.234.12 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"400e11deddf4560e0cfd3d5a8d9c473a9ee55e92b3c6edb341ed039ac56c5cfa"; reference:url,publicmosaic.com/indicators; sid:9100255; rev:2;)
alert tcp $HOME_NET any -> 47.82.234.12 8443 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9100261; rev:2;)
alert tls $HOME_NET any -> 47.82.234.12 8444 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"2c746495dde82a8d4b4e7c069cb3554e737997629035bfd3ad511010351ff903"; reference:url,publicmosaic.com/indicators; sid:9100248; rev:2;)
alert tls $HOME_NET any -> 47.82.234.12 8848 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"cbc15259f848d3089de52ec88c94b09180887a66a4d1dba8fb2e1d55581a6f4a"; reference:url,publicmosaic.com/indicators; sid:9100282; rev:2;)
alert tls $HOME_NET any -> 47.83.3.103 10443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"858ae53e03c0c0dbd14f8df3b9fccb7c0e8a9577beef5c05e3ad3f1cc529c9ae"; reference:url,publicmosaic.com/indicators; sid:9103418; rev:2;)
alert tls $HOME_NET any -> 47.83.134.97 443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"300f4dbaffabc44715dd7f4a1ffb4b04cc367cf27ef2cda7eba5a210bd902693"; reference:url,publicmosaic.com/indicators; sid:9100576; rev:2;)
alert tls $HOME_NET any -> 47.83.217.23 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"659f546f8f8549784a2579124c73091c49203c4679d931a673cb4b1b472c8357"; reference:url,publicmosaic.com/indicators; sid:9105196; rev:2;)
alert tcp $HOME_NET any -> 47.84.3.75 21731 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9103782; rev:2;)
alert tls $HOME_NET any -> 47.84.50.235 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100211; rev:2;)
alert tls $HOME_NET any -> 47.84.125.171 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"0746f5948d21c602c1eec2494e5604c1542c2499d5b29cc5697993b3065adcce"; reference:url,publicmosaic.com/indicators; sid:9103708; rev:2;)
alert tls $HOME_NET any -> 47.84.141.91 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"ce95b02de3bd26782872ff4bd1d97be5a5e9d6cfa618144714746682ec016dc0"; reference:url,publicmosaic.com/indicators; sid:9105166; rev:2;)
alert tcp $HOME_NET any -> 47.86.9.253 10982 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9101142; rev:2;)
alert tls $HOME_NET any -> 47.86.9.253 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"f9cdc3da3b6999dda4a5dfe1a0f5ca5697147c32a00dba81e576fd4901addbe1"; reference:url,publicmosaic.com/indicators; sid:9100242; rev:2;)
alert tcp $HOME_NET any -> 47.86.14.173 8080 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103050; rev:2;)
alert tcp $HOME_NET any -> 47.86.82.95 8081 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103049; rev:2;)
alert tls $HOME_NET any -> 47.86.97.42 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9102241; rev:2;)
alert tcp $HOME_NET any -> 47.86.171.139 6789 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106339; rev:2;)
alert tls $HOME_NET any -> 47.86.184.71 10443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9103464; rev:2;)
alert tls $HOME_NET any -> 47.87.84.177 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"dfa6d06646a8c4625224a104d45f90bfa5b1fd6c27ea9ed86f854c40aeb432f4"; reference:url,publicmosaic.com/indicators; sid:9100539; rev:2;)
alert tls $HOME_NET any -> 47.88.78.167 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"33dc87a7a114888d9e15fb4f664560efb15e51b86bb784d0a664a240c6a85e7c"; reference:url,publicmosaic.com/indicators; sid:9105160; rev:2;)
alert tls $HOME_NET any -> 47.89.175.103 443 (msg:"HOLLOWPOINT exposed tool ligolo"; tls.cert_fingerprint; content:"8681653c2987fc4f66efd1c9460465f8646b838839b6ca4e7b4057ce9ba7787c"; reference:url,publicmosaic.com/indicators; sid:9101693; rev:2;)
alert tls $HOME_NET any -> 47.89.175.103 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"45a7a202f2135ae3f24912b27159190a0b037d6e76fc482b417d6631bbe5a773"; reference:url,publicmosaic.com/indicators; sid:9100390; rev:2;)
alert tcp $HOME_NET any -> 47.90.209.157 18084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106064; rev:2;)
alert tls $HOME_NET any -> 47.90.209.157 54321 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c376478"; reference:url,publicmosaic.com/indicators; sid:9105823; rev:2;)
alert tls $HOME_NET any -> 47.91.30.143 40000 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"ad7f791d3cc344eb2da70149849c3ccbc131deb14ba7e42063a765844985e866"; reference:url,publicmosaic.com/indicators; sid:9103707; rev:2;)
alert tcp $HOME_NET any -> 47.236.1.187 8443 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9101310; rev:2;)
alert tls $HOME_NET any -> 47.236.56.15 4445 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9105338; rev:2;)
alert tls $HOME_NET any -> 47.236.56.15 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"12141108173fe7f1e1e1c53e2657357a975e639e45b65c005428ee06dccc3f3f"; reference:url,publicmosaic.com/indicators; sid:9105339; rev:2;)
alert tcp $HOME_NET any -> 47.236.83.240 8899 (msg:"HOLLOWPOINT C2 darksword"; reference:url,publicmosaic.com/indicators; sid:9105961; rev:2;)
alert tls $HOME_NET any -> 47.236.83.240 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"fa062fd8e48445f251b0694635fbf808f5c5094c83ffd69a795cfab7ddcaed55"; reference:url,publicmosaic.com/indicators; sid:9105171; rev:2;)
alert tcp $HOME_NET any -> 47.236.113.37 8443 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9103671; rev:2;)
alert tcp $HOME_NET any -> 47.236.122.197 8443 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9103670; rev:2;)
alert tcp $HOME_NET any -> 47.236.130.154 2095 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103006; rev:2;)
alert tcp $HOME_NET any -> 47.236.130.154 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9101440; rev:2;)
alert tcp $HOME_NET any -> 47.236.130.154 58357 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103005; rev:2;)
alert tcp $HOME_NET any -> 47.236.197.86 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9100976; rev:2;)
alert tcp $HOME_NET any -> 47.236.202.216 80 (msg:"HOLLOWPOINT C2 adaptix"; reference:url,publicmosaic.com/indicators; sid:9106648; rev:2;)
alert tcp $HOME_NET any -> 47.236.204.56 3695 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103004; rev:2;)
alert tcp $HOME_NET any -> 47.237.68.187 40801 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103003; rev:2;)
alert tls $HOME_NET any -> 47.237.100.236 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"1b86134d2e23de8018192dfd1e13caff230007bea5b0e198437ec7849f8640a2"; reference:url,publicmosaic.com/indicators; sid:9100716; rev:2;)
alert tls $HOME_NET any -> 47.237.100.236 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"5b72209c38e50c84b5cf00a68f2fe131abf633e45061eda447748f9b246f52ba"; reference:url,publicmosaic.com/indicators; sid:9100386; rev:2;)
alert tcp $HOME_NET any -> 47.237.156.196 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9100974; rev:2;)
alert tcp $HOME_NET any -> 47.238.6.14 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105631; rev:2;)
alert tcp $HOME_NET any -> 47.238.7.198 4444 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103002; rev:2;)
alert tcp $HOME_NET any -> 47.238.112.8 50888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9101143; rev:2;)
alert tls $HOME_NET any -> 47.239.61.167 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"1c9312227b077be0f1ccfccff05ceb0276c0815349b39568b856f0982a47b23b"; reference:url,publicmosaic.com/indicators; sid:9104683; rev:2;)
alert tls $HOME_NET any -> 47.239.116.237 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"9d23f3e9b08a184a67ed7b93364fb13bcfc199702704921dbb05a59b893255a1"; reference:url,publicmosaic.com/indicators; sid:9106011; rev:2;)
alert tcp $HOME_NET any -> 47.239.223.39 5678 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103001; rev:2;)
alert tcp $HOME_NET any -> 47.239.223.39 8123 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103000; rev:2;)
alert tcp $HOME_NET any -> 47.242.62.96 15800 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9101141; rev:2;)
alert tcp $HOME_NET any -> 47.243.177.251 8083 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102999; rev:2;)
alert tcp $HOME_NET any -> 47.243.241.78 60607 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102998; rev:2;)
alert tcp $HOME_NET any -> 47.243.241.78 60609 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102997; rev:2;)
alert tcp $HOME_NET any -> 47.250.190.129 80 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102996; rev:2;)
alert tcp $HOME_NET any -> 47.250.190.129 8083 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102995; rev:2;)
alert tcp $HOME_NET any -> 47.250.190.129 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102994; rev:2;)
alert tls $HOME_NET any -> 47.251.29.219 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"33dc87a7a114888d9e15fb4f664560efb15e51b86bb784d0a664a240c6a85e7c"; reference:url,publicmosaic.com/indicators; sid:9105159; rev:2;)
alert tls $HOME_NET any -> 47.251.165.63 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"33dc87a7a114888d9e15fb4f664560efb15e51b86bb784d0a664a240c6a85e7c"; reference:url,publicmosaic.com/indicators; sid:9105150; rev:2;)
alert tls $HOME_NET any -> 47.251.177.187 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"33dc87a7a114888d9e15fb4f664560efb15e51b86bb784d0a664a240c6a85e7c"; reference:url,publicmosaic.com/indicators; sid:9105163; rev:2;)
alert tls $HOME_NET any -> 47.254.46.30 60891 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"68a889b3805cce6374e4a78b2a0bf78c2a6c51fb8cfbc7c720b8d15006844166"; reference:url,publicmosaic.com/indicators; sid:9103386; rev:2;)
alert tcp $HOME_NET any -> 47.254.73.23 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100487; rev:2;)
alert tcp $HOME_NET any -> 47.254.173.184 8443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9100970; rev:2;)