# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 60 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: asn 55990 — https://publicmosaic.com/asn/55990
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 0
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tcp $HOME_NET any -> 1.92.101.103 60000 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103294; rev:2;)
alert tls $HOME_NET any -> 1.92.135.168 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"a598b57d3b276a021f2c0867654c92b886f4a1e7f3e1d8149ea90a7dc6b48cab"; reference:url,publicmosaic.com/indicators; sid:9102211; rev:2;)
alert tcp $HOME_NET any -> 1.92.135.168 8032 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9102210; rev:2;)
alert tcp $HOME_NET any -> 1.92.135.168 8080 (msg:"HOLLOWPOINT C2 adaptix"; reference:url,publicmosaic.com/indicators; sid:9100688; rev:2;)
alert tcp $HOME_NET any -> 1.94.65.9 2147 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9101571; rev:2;)
alert tcp $HOME_NET any -> 1.94.176.236 10000 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103293; rev:2;)
alert tcp $HOME_NET any -> 1.94.176.236 10001 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103292; rev:2;)
alert tcp $HOME_NET any -> 1.94.234.157 5555 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102580; rev:2;)
alert tcp $HOME_NET any -> 60.204.152.14 53 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102954; rev:2;)
alert tcp $HOME_NET any -> 60.204.152.14 3306 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102953; rev:2;)
alert tcp $HOME_NET any -> 60.204.152.14 5551 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102952; rev:2;)
alert tcp $HOME_NET any -> 60.204.152.14 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102951; rev:2;)
alert tcp $HOME_NET any -> 60.204.240.193 10000 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101006; rev:2;)
alert tls $HOME_NET any -> 110.41.76.236 5678 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"4aaff9d0e258538fc722e121064d4e5ef50f570cfa29243b825103420c26de10"; reference:url,publicmosaic.com/indicators; sid:9103370; rev:2;)
alert tcp $HOME_NET any -> 110.41.77.213 6666 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102490; rev:2;)
alert tcp $HOME_NET any -> 110.41.77.213 6667 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102489; rev:2;)
alert tcp $HOME_NET any -> 110.41.150.118 8443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106413; rev:2;)
alert tcp $HOME_NET any -> 110.41.162.83 6379 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102488; rev:2;)
alert tcp $HOME_NET any -> 113.44.78.152 8088 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102871; rev:2;)
alert tcp $HOME_NET any -> 113.44.78.152 18088 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102870; rev:2;)
alert tls $HOME_NET any -> 113.44.89.87 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9100731; rev:2;)
alert tls $HOME_NET any -> 113.44.90.0 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9100730; rev:2;)
alert tcp $HOME_NET any -> 113.44.90.135 12346 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105935; rev:2;)
alert tcp $HOME_NET any -> 113.44.152.115 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102481; rev:2;)
alert tls $HOME_NET any -> 113.44.168.133 8080 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"bee4e90f14244974a24f1ed9e1161e9e3ad88578692d71e017876994c60ba44a"; reference:url,publicmosaic.com/indicators; sid:9100607; rev:2;)
alert tcp $HOME_NET any -> 113.45.28.96 8878 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102480; rev:2;)
alert tcp $HOME_NET any -> 113.45.168.139 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100959; rev:2;)
alert tcp $HOME_NET any -> 113.45.168.139 8433 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103621; rev:2;)
alert tcp $HOME_NET any -> 113.45.176.42 55091 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102479; rev:2;)
alert tcp $HOME_NET any -> 113.45.176.42 55193 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102478; rev:2;)
alert tcp $HOME_NET any -> 113.45.176.42 55292 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102477; rev:2;)
alert tcp $HOME_NET any -> 113.45.196.228 222 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102476; rev:2;)
alert tcp $HOME_NET any -> 113.45.206.160 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102475; rev:2;)
alert tcp $HOME_NET any -> 113.45.224.122 16688 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102474; rev:2;)
alert tcp $HOME_NET any -> 113.45.227.85 8080 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102473; rev:2;)
alert tcp $HOME_NET any -> 113.45.227.85 8848 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102472; rev:2;)
alert tcp $HOME_NET any -> 113.45.227.85 8869 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102471; rev:2;)
alert tcp $HOME_NET any -> 113.45.227.85 8899 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102470; rev:2;)
alert tcp $HOME_NET any -> 113.45.227.85 60000 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102469; rev:2;)
alert tls $HOME_NET any -> 113.45.238.149 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"5c6f16525aef0e976d40c982ebc9677986547005615e208e67627b5994abe034"; reference:url,publicmosaic.com/indicators; sid:9102292; rev:2;)
alert tcp $HOME_NET any -> 113.45.238.149 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100504; rev:2;)
alert tls $HOME_NET any -> 113.45.253.80 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100722; rev:2;)
alert tcp $HOME_NET any -> 113.45.253.80 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102468; rev:2;)
alert tcp $HOME_NET any -> 115.120.246.15 10000 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102869; rev:2;)
alert tcp $HOME_NET any -> 116.204.119.99 1234 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102444; rev:2;)
alert tcp $HOME_NET any -> 116.204.119.99 42314 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102443; rev:2;)
alert tls $HOME_NET any -> 116.204.119.99 52034 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"c03904028e11ec0fa2cf303ad8b00b6ceb78463b31fa0eae5333d87c2e79fae4"; reference:url,publicmosaic.com/indicators; sid:9105184; rev:2;)
alert tcp $HOME_NET any -> 116.205.106.137 9997 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104678; rev:2;)
alert tcp $HOME_NET any -> 116.205.106.137 10051 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9102442; rev:2;)
alert tcp $HOME_NET any -> 116.205.118.254 8083 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104677; rev:2;)
alert tcp $HOME_NET any -> 116.205.137.86 3389 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104583; rev:2;)
alert tcp $HOME_NET any -> 116.205.186.56 9080 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102441; rev:2;)
alert tcp $HOME_NET any -> 119.3.85.18 4443 (msg:"HOLLOWPOINT C2 quasar_rat"; reference:url,publicmosaic.com/indicators; sid:9106651; rev:2;)
alert tcp $HOME_NET any -> 119.3.155.80 1234 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101188; rev:2;)
alert tcp $HOME_NET any -> 123.60.33.187 8080 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102853; rev:2;)
alert tcp $HOME_NET any -> 123.60.84.127 8666 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102418; rev:2;)
alert tcp $HOME_NET any -> 124.70.142.36 8020 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102416; rev:2;)
alert tcp $HOME_NET any -> 139.9.66.163 36127 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104549; rev:2;)
alert tcp $HOME_NET any -> 139.9.143.101 7711 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102842; rev:2;)
alert tcp $HOME_NET any -> 139.159.153.21 1086 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102385; rev:2;)