# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 12 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: asn 62468 — https://publicmosaic.com/asn/62468
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 0
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tls $HOME_NET any -> 23.148.212.86 2053 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"63a2da031ea5cbd764cb607ee9f438d051203d3e0b793b801dd63ab01b39d4da"; reference:url,publicmosaic.com/indicators; sid:9100414; rev:2;)
alert tls $HOME_NET any -> 23.148.212.123 2053 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"ab98cb64960c77bcc8734dc53aad62d8482664b32e2d1adab74dd5004c5bc42a"; reference:url,publicmosaic.com/indicators; sid:9100018; rev:2;)
alert tcp $HOME_NET any -> 23.148.212.176 80 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9101651; rev:2;)
alert tcp $HOME_NET any -> 23.148.212.219 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103219; rev:2;)
alert tcp $HOME_NET any -> 23.148.212.219 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103218; rev:2;)
alert tls $HOME_NET any -> 23.148.212.254 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"12033c3063b2a5b1fa63959a65362cf7a8b70784d8221b3b879b7b3264479284"; reference:url,publicmosaic.com/indicators; sid:9105293; rev:2;)
alert tls $HOME_NET any -> 103.250.172.230 8443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"713316dfa832c897699c79806bb1526e4b9448cf40a41c3416883bd0a148d211"; reference:url,publicmosaic.com/indicators; sid:9106210; rev:2;)
alert tls $HOME_NET any -> 103.250.172.230 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"a1b317b4efea8f1c9ff26a4b4fdcf172b3bf8f7bb7aad44624cfeb36bad47f0d"; reference:url,publicmosaic.com/indicators; sid:9101744; rev:2;)
alert tcp $HOME_NET any -> 107.151.233.120 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9100961; rev:2;)
alert tcp $HOME_NET any -> 156.239.252.191 448 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9104849; rev:2;)
alert tls $HOME_NET any -> 156.239.252.191 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"bcf512078e6c9a5bfd38514b268df56c6ec11527eff5d808bb4a20e2599f7b8d"; reference:url,publicmosaic.com/indicators; sid:9105161; rev:2;)
alert tcp $HOME_NET any -> 198.44.182.236 9527 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106017; rev:2;)