# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 39 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: asn 51167 — https://publicmosaic.com/asn/51167
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 1
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tls $HOME_NET any -> 31.220.74.13 8443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"c11917994ca842322f4b999b3e1b1e328ceff514aa5b6c9cf88787d47e61bc63"; reference:url,publicmosaic.com/indicators; sid:9103715; rev:2;)
alert tls $HOME_NET any -> 31.220.93.222 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"d4584baf214871605ca530f61dd69126969a270602a095a7619f1397fd07e283"; reference:url,publicmosaic.com/indicators; sid:9100474; rev:2;)
alert tls $HOME_NET any -> 38.242.141.45 443 (msg:"HOLLOWPOINT C2 metasploit_meterpreter"; tls.cert_fingerprint; content:"a2de67cb60a78dd0f8d9fa0e522448e7178a239a285a91b80413d77c1b8770dc"; reference:url,publicmosaic.com/indicators; sid:9103935; rev:2;)
alert tcp $HOME_NET any -> 62.171.148.175 6606 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9106730; rev:2;)
alert tcp $HOME_NET any -> 62.171.148.175 7707 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9106628; rev:2;)
alert tcp $HOME_NET any -> 62.171.163.207 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9103327; rev:2;)
alert tcp $HOME_NET any -> 77.237.240.107 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9101611; rev:2;)
alert tls $HOME_NET any -> 81.17.100.251 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"a61212066303d57ae0a2c1af8d085b64bfee9aebf7cc9ba7cc3f33529ff2d075"; reference:url,publicmosaic.com/indicators; sid:9106619; rev:2;)
alert tcp $HOME_NET any -> 82.208.23.183 80 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9104001; rev:2;)
alert tcp $HOME_NET any -> 84.46.251.62 443 (msg:"HOLLOWPOINT C2 adaptix"; reference:url,publicmosaic.com/indicators; sid:9100662; rev:2;)
alert tls $HOME_NET any -> 84.46.251.62 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"fd7d09e4ee86ce4be363f480cb80679897bbf3d51ecd74ab877641737b3b2203"; reference:url,publicmosaic.com/indicators; sid:9100468; rev:2;)
alert tcp $HOME_NET any -> 84.247.132.220 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9103324; rev:2;)
alert tcp $HOME_NET any -> 84.247.166.79 8080 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9103323; rev:2;)
alert tcp $HOME_NET any -> 84.247.182.55 8080 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9101608; rev:2;)
alert tcp $HOME_NET any -> 84.247.187.47 80 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9106575; rev:2;)
alert tcp $HOME_NET any -> 84.247.187.47 6661 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9106729; rev:2;)
alert tcp $HOME_NET any -> 84.247.187.47 8115 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9106728; rev:2;)
alert tcp $HOME_NET any -> 84.247.187.47 9011 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9106727; rev:2;)
alert tcp $HOME_NET any -> 84.247.187.47 9990 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9106726; rev:2;)
alert tls $HOME_NET any -> 84.247.191.49 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"794c80002bd3ed61a7dfd8122335e2a3306c4b56a01b612b4fdff7cbe904a266"; reference:url,publicmosaic.com/indicators; sid:9100367; rev:2;)
alert tcp $HOME_NET any -> 89.116.24.9 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9104205; rev:2;)
alert tcp $HOME_NET any -> 89.116.31.27 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9103783; rev:2;)
alert tls $HOME_NET any -> 109.123.245.205 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"7c3325b73801b3b35f84ef71990a1aec768841bbfdaa60e3b339ba84098a21e0"; reference:url,publicmosaic.com/indicators; sid:9104995; rev:2;)
alert tcp $HOME_NET any -> 109.123.245.205 4433 (msg:"HOLLOWPOINT C2 adaptix"; reference:url,publicmosaic.com/indicators; sid:9106822; rev:2;)
alert tcp $HOME_NET any -> 109.199.102.87 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9105784; rev:2;)
alert tls $HOME_NET any -> 109.199.126.209 8443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"43f616b4d5fb5d72e9d784c97d11238a645fa802371020534c8d982b5efc4764"; reference:url,publicmosaic.com/indicators; sid:9101945; rev:2;)
alert tls $HOME_NET any -> 109.205.181.248 443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"a5ec865c3282466b012779c467452942b57d8dd27d842be07b7ede4404c51c79"; reference:url,publicmosaic.com/indicators; sid:9100554; rev:2;)
alert tls $HOME_NET any -> 109.205.181.248 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"58e2d5fff95ec226861cefe82989b0c070943688bd027674e6411bc1a4f68387"; reference:url,publicmosaic.com/indicators; sid:9100531; rev:2;)
alert tls $HOME_NET any -> 158.220.101.234 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"62b770a71ab9fe547ffdeebab88538b06d708b01331f0f0a33c5d9aa6fd0e800"; reference:url,publicmosaic.com/indicators; sid:9103833; rev:2;)
alert tcp $HOME_NET any -> 161.97.89.221 5173 (msg:"HOLLOWPOINT C2 overlord"; reference:url,publicmosaic.com/indicators; sid:9102044; rev:2;)
alert tls $HOME_NET any -> 161.97.127.87 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"da899a762848291c722a9140a836fa7edcc76c994c109a4d5401ed56acd87717"; reference:url,publicmosaic.com/indicators; sid:9105200; rev:2;)
alert tls $HOME_NET any -> 161.97.185.123 1478 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"fb2de06b98b8a1eae876621c9d4a147dc0c3cfa77b25ed82f9663d4e1e6c1eef"; reference:url,publicmosaic.com/indicators; sid:9105178; rev:2;)
alert tls $HOME_NET any -> 164.68.123.50 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"bfb8f9a46992f6828544a1d1ac5ac3ecdf0eb403623fbad7e338b569386ee22b"; reference:url,publicmosaic.com/indicators; sid:9100457; rev:2;)
alert tcp $HOME_NET any -> 173.249.24.135 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103476; rev:2;)
alert tcp $HOME_NET any -> 173.249.41.141 80 (msg:"HOLLOWPOINT C2 havoc"; reference:url,publicmosaic.com/indicators; sid:9100564; rev:2;)
alert tls $HOME_NET any -> 173.249.41.141 40056 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"415603450366b957da78b16b8a34353ca0c5d4d5a7f35d2f4f758d7e106f480e"; reference:url,publicmosaic.com/indicators; sid:9105677; rev:2;)
alert tcp $HOME_NET any -> 185.193.66.120 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9103308; rev:2;)
alert tcp $HOME_NET any -> 185.213.25.37 8848 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9103816; rev:2;)
alert tls $HOME_NET any -> 213.199.53.152 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"2b1a381b6ce13c62bdcbe0edcb9d24f809337d43bda7ce260a14c5181494549b"; reference:url,publicmosaic.com/indicators; sid:9101562; rev:2;)