# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 82 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: asn 8075 — https://publicmosaic.com/asn/8075
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 0
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tls $HOME_NET any -> 4.154.203.165 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"40258b5ce1b9197fd0d48c1f2450dd3e554237487a1d4fd924c71680223668c1"; reference:url,publicmosaic.com/indicators; sid:9104239; rev:2;)
alert tls $HOME_NET any -> 4.154.203.165 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"614240bb1a61dc1dcf4d902132e5055019b95a94803c774f6bce39c5a446e8be"; reference:url,publicmosaic.com/indicators; sid:9105001; rev:2;)
alert tcp $HOME_NET any -> 4.193.136.143 80 (msg:"HOLLOWPOINT C2 havoc"; reference:url,publicmosaic.com/indicators; sid:9100583; rev:2;)
alert tls $HOME_NET any -> 4.193.136.143 443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"98dfe4210517e50c68c6e82157f7d99cc41d012b29bff1d46fc53eb8dcb16927"; reference:url,publicmosaic.com/indicators; sid:9100569; rev:2;)
alert tls $HOME_NET any -> 4.230.24.119 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"10de9ec4c5b08e5442973c041e51b3c4f3a1aebd90d546b8dd4d3945d60bee26"; reference:url,publicmosaic.com/indicators; sid:9106196; rev:2;)
alert tcp $HOME_NET any -> 4.230.24.119 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9105294; rev:2;)
alert tls $HOME_NET any -> 4.246.219.92 443 (msg:"HOLLOWPOINT exposed tool ligolo"; tls.cert_fingerprint; content:"8f0b807d31abdc301112e7ec40ddeba57c5cb1cface080146d999aa2c12f876b"; reference:url,publicmosaic.com/indicators; sid:9101697; rev:2;)
alert tls $HOME_NET any -> 4.253.8.171 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100221; rev:2;)
alert tls $HOME_NET any -> 9.223.178.81 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"09098b56efce1ca0ea0770c709134223f38854fdff7d5fc294c843a86108a920"; reference:url,publicmosaic.com/indicators; sid:9101917; rev:2;)
alert tls $HOME_NET any -> 20.2.87.168 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"f586e806f6bf76543d46f2cab20d11044407fe1a9ee34b85443431ef88453c4d"; reference:url,publicmosaic.com/indicators; sid:9100543; rev:2;)
alert tls $HOME_NET any -> 20.2.90.98 80 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"65aece09752865e4abb571f921de9f4cec6d3c27c421022ac0758d154da55ef1"; reference:url,publicmosaic.com/indicators; sid:9102016; rev:2;)
alert tcp $HOME_NET any -> 20.2.90.98 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9102015; rev:2;)
alert tls $HOME_NET any -> 20.2.139.87 6378 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"79f0c4e7b07d606d679e7eb9344a925a1a14a9c7c10c6e9885cab446471c5705"; reference:url,publicmosaic.com/indicators; sid:9102014; rev:2;)
alert tcp $HOME_NET any -> 20.2.139.87 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100486; rev:2;)
alert tls $HOME_NET any -> 20.2.140.201 8443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"e52ce0cb37e4e5eb28ffb7be345fb72158701d801f0907f1104659eacf73b75d"; reference:url,publicmosaic.com/indicators; sid:9103896; rev:2;)
alert tls $HOME_NET any -> 20.2.140.201 40056 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"96ec4421ae52bc0763d58b769aee1941870407f0e62fc57254dcf5cf181e3c1c"; reference:url,publicmosaic.com/indicators; sid:9104180; rev:2;)
alert tls $HOME_NET any -> 20.2.161.33 6378 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"79f0c4e7b07d606d679e7eb9344a925a1a14a9c7c10c6e9885cab446471c5705"; reference:url,publicmosaic.com/indicators; sid:9103638; rev:2;)
alert tcp $HOME_NET any -> 20.2.161.33 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100499; rev:2;)
alert tls $HOME_NET any -> 20.15.58.107 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100209; rev:2;)
alert tls $HOME_NET any -> 20.15.58.107 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"92d337a8b451d5d41d6809d11318f26d0da22ff81b4da8f97bffbfa04f5c494b"; reference:url,publicmosaic.com/indicators; sid:9100243; rev:2;)
alert tls $HOME_NET any -> 20.39.60.137 443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"0cfcc6df36b4da5e87c2ae5a78a367c2defc46283d4bf49dab9fa1e26a8c108c"; reference:url,publicmosaic.com/indicators; sid:9100562; rev:2;)
alert tls $HOME_NET any -> 20.62.126.164 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"92c86d3721e7bc274f8d68cd69827fc49ecfc06336108ef8d0cd70cc5b6d50fd"; reference:url,publicmosaic.com/indicators; sid:9101921; rev:2;)
alert tls $HOME_NET any -> 20.63.75.128 1488 (msg:"HOLLOWPOINT C2 raton_rat"; tls.cert_fingerprint; content:"23a2e6c8bba29d9573f0b4698da369350fcad9f8638feff2bd69f79638f88a6f"; reference:url,publicmosaic.com/indicators; sid:9105104; rev:2;)
alert tls $HOME_NET any -> 20.74.145.114 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"9b74ce41c17154e9c12630fde77a61153a4e4de5eaef5247c47ce5fc01247d6d"; reference:url,publicmosaic.com/indicators; sid:9100159; rev:2;)
alert tls $HOME_NET any -> 20.89.182.93 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"586cebb74acbe060eb8f57c4fda193d29655e2dad286980dd11e97c3fcd77633"; reference:url,publicmosaic.com/indicators; sid:9104235; rev:2;)
alert tcp $HOME_NET any -> 20.89.182.93 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100490; rev:2;)
alert tls $HOME_NET any -> 20.115.112.185 443 (msg:"HOLLOWPOINT exposed tool ligolo"; tls.cert_fingerprint; content:"3d0147473d7c167021f749fb47b37cece531a30885bea177e395ff7938b86026"; reference:url,publicmosaic.com/indicators; sid:9101696; rev:2;)
alert tcp $HOME_NET any -> 20.115.112.186 443 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9104052; rev:2;)
alert tls $HOME_NET any -> 20.115.227.161 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"d88dc741bc13d14a0e4669ddb6efe453df0c058ddaaa627001070421f8d6088c"; reference:url,publicmosaic.com/indicators; sid:9100072; rev:2;)
alert tls $HOME_NET any -> 20.118.221.53 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"59c7b6503aea0ed8b2e046b74b6fcfaf3821f71f57ce98a18088099680aae5ed"; reference:url,publicmosaic.com/indicators; sid:9106444; rev:2;)
alert tls $HOME_NET any -> 20.118.221.53 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"5e9b002658c37ea18c1bb54d51597a124fbe8a4c4cbc1888c593c89fdaaa12ab"; reference:url,publicmosaic.com/indicators; sid:9105544; rev:2;)
alert tls $HOME_NET any -> 20.118.243.73 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"8e710ba12ede9d6d42fd771951ca4f71e18e40a3a751b80c7b14badd5d31f2cd"; reference:url,publicmosaic.com/indicators; sid:9100398; rev:2;)
alert tls $HOME_NET any -> 20.119.73.195 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"b9f161c65ab5abd68dd6e2e1f430fd1256ae3ab982560127774fd6ff42812f52"; reference:url,publicmosaic.com/indicators; sid:9101461; rev:2;)
alert tls $HOME_NET any -> 20.119.73.195 31337 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"788f28fb1e6954cf35f4ab1a76ae3910f232a91df3bded06b39370108b0f16d3"; reference:url,publicmosaic.com/indicators; sid:9101459; rev:2;)
alert tcp $HOME_NET any -> 20.121.198.242 443 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9104505; rev:2;)
alert tcp $HOME_NET any -> 20.127.87.129 443 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9105647; rev:2;)
alert tls $HOME_NET any -> 20.127.244.233 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"255a6f7225512f11a9820fdc5b799d5ed84c5f2e792e4490275c57be107fca72"; reference:url,publicmosaic.com/indicators; sid:9100400; rev:2;)
alert tcp $HOME_NET any -> 20.187.120.42 8080 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9100253; rev:2;)
alert tls $HOME_NET any -> 20.187.120.42 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c376478"; reference:url,publicmosaic.com/indicators; sid:9100237; rev:2;)
alert tcp $HOME_NET any -> 20.189.122.18 44446 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103229; rev:2;)
alert tls $HOME_NET any -> 20.196.147.118 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"665beb25ab526df019b93c2421c7e8972310439518719f05127d578df4c8cc62"; reference:url,publicmosaic.com/indicators; sid:9102013; rev:2;)
alert tcp $HOME_NET any -> 20.196.147.118 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100488; rev:2;)
alert tls $HOME_NET any -> 20.200.61.22 443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"50e6418c8f0f46d3a685706c1aedf9baf77c136c5af78921a6ff3160a19049ed"; reference:url,publicmosaic.com/indicators; sid:9100545; rev:2;)
alert tls $HOME_NET any -> 20.205.136.20 65350 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"7bf4bd9b6413be38247241fb2b8f3a8b25d0466983f48300982f3399b1c61fa9"; reference:url,publicmosaic.com/indicators; sid:9106211; rev:2;)
alert tls $HOME_NET any -> 20.206.67.182 443 (msg:"HOLLOWPOINT exposed tool ligolo"; tls.cert_fingerprint; content:"b50f8fa45462a3fa82c325b9d1adf957eb5fd8b8b9f703b8924341e9c05507be"; reference:url,publicmosaic.com/indicators; sid:9101695; rev:2;)
alert tls $HOME_NET any -> 20.206.67.182 2083 (msg:"HOLLOWPOINT exposed tool ligolo"; tls.cert_fingerprint; content:"b50f8fa45462a3fa82c325b9d1adf957eb5fd8b8b9f703b8924341e9c05507be"; reference:url,publicmosaic.com/indicators; sid:9101694; rev:2;)
alert tcp $HOME_NET any -> 20.218.121.193 4449 (msg:"HOLLOWPOINT C2 quasar_rat"; reference:url,publicmosaic.com/indicators; sid:9106561; rev:2;)
alert tcp $HOME_NET any -> 20.218.121.193 8080 (msg:"HOLLOWPOINT C2 quasar_rat"; reference:url,publicmosaic.com/indicators; sid:9106471; rev:2;)
alert tls $HOME_NET any -> 20.220.105.236 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"e5c9d1aefb6f5a3f570d78972b533fd039c02d93e935ca85a28087d27a99fa63"; reference:url,publicmosaic.com/indicators; sid:9105344; rev:2;)
alert tcp $HOME_NET any -> 20.245.10.22 27015 (msg:"HOLLOWPOINT C2 quasar_rat"; reference:url,publicmosaic.com/indicators; sid:9106807; rev:2;)
alert tls $HOME_NET any -> 20.255.154.56 80 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"65aece09752865e4abb571f921de9f4cec6d3c27c421022ac0758d154da55ef1"; reference:url,publicmosaic.com/indicators; sid:9102012; rev:2;)
alert tcp $HOME_NET any -> 20.255.154.56 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100493; rev:2;)
alert tls $HOME_NET any -> 40.67.146.12 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"206a64c0ac01d02eb8750d72f88f009339dbc550209060cf1bf5e7f4087c3078"; reference:url,publicmosaic.com/indicators; sid:9104969; rev:2;)
alert tls $HOME_NET any -> 40.90.235.75 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"fccdbd5251090212fa31a40f6ad27ab1eed63a21ce87f758a6f649a5a673709e"; reference:url,publicmosaic.com/indicators; sid:9105000; rev:2;)
alert tls $HOME_NET any -> 40.124.184.160 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"cfca26fde7c6d85d00961fa89e8f094a6bb5d8bf7eedf62a3ba8bb96ae9204ea"; reference:url,publicmosaic.com/indicators; sid:9102008; rev:2;)
alert tls $HOME_NET any -> 40.124.184.160 8443 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"cfca26fde7c6d85d00961fa89e8f094a6bb5d8bf7eedf62a3ba8bb96ae9204ea"; reference:url,publicmosaic.com/indicators; sid:9101738; rev:2;)
alert tcp $HOME_NET any -> 51.124.247.149 139 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9101613; rev:2;)
alert tls $HOME_NET any -> 52.143.174.249 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"340770e22b7e54175718025c4eb8dd2a11d21ee53de4b8935e218a4d479d1e96"; reference:url,publicmosaic.com/indicators; sid:9100382; rev:2;)
alert tls $HOME_NET any -> 52.173.131.28 4444 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"243a3b5f1d6f598fd773c42f0156acc3b736e1a87041415adf3fbba2a5e7dc5c"; reference:url,publicmosaic.com/indicators; sid:9100380; rev:2;)
alert tls $HOME_NET any -> 52.175.50.182 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"f9e68795f3190606058dda701a8ca12a3ecc5963d5f0b5ccbd7fd362dbc3bb2c"; reference:url,publicmosaic.com/indicators; sid:9101299; rev:2;)
alert tls $HOME_NET any -> 52.188.156.51 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"2ddeb6ddeab66e1849ce2102ebcc864259d9228177359bf49a2ae40f29da9e5b"; reference:url,publicmosaic.com/indicators; sid:9101930; rev:2;)
alert tls $HOME_NET any -> 52.241.248.38 56001 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"f9e0f3b32a76084b22764eaebf4835b723a3f2430fa6266aa4759a23467b40a3"; reference:url,publicmosaic.com/indicators; sid:9100880; rev:2;)
alert tls $HOME_NET any -> 52.241.248.38 56002 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"f9e0f3b32a76084b22764eaebf4835b723a3f2430fa6266aa4759a23467b40a3"; reference:url,publicmosaic.com/indicators; sid:9101139; rev:2;)
alert tls $HOME_NET any -> 52.241.248.38 56003 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"f9e0f3b32a76084b22764eaebf4835b723a3f2430fa6266aa4759a23467b40a3"; reference:url,publicmosaic.com/indicators; sid:9101138; rev:2;)
alert tls $HOME_NET any -> 52.248.41.253 8443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100212; rev:2;)
alert tls $HOME_NET any -> 57.158.27.132 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"588587c78081378a58269b137eef127af411d92e5f1a8f29f6a1877c639765f3"; reference:url,publicmosaic.com/indicators; sid:9100379; rev:2;)
alert tls $HOME_NET any -> 72.155.73.165 4782 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"ecc36d8ae6982617b86bdfadc32da855890f57c512e31332879e8470b386398c"; reference:url,publicmosaic.com/indicators; sid:9100040; rev:2;)
alert tls $HOME_NET any -> 104.211.21.237 443 (msg:"HOLLOWPOINT exposed tool ligolo"; tls.cert_fingerprint; content:"0cb6f12e4024ce87f9a4feebb36b67782e8fb9bb2e352498b63a3e3ab2d62fbe"; reference:url,publicmosaic.com/indicators; sid:9101690; rev:2;)
alert tls $HOME_NET any -> 104.214.176.148 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"8b7c493ef2d13f29d4461ca64254cf5960e4c592028ade294b7b4773953bf6a1"; reference:url,publicmosaic.com/indicators; sid:9101993; rev:2;)
alert tls $HOME_NET any -> 104.214.176.148 9527 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"8b7c493ef2d13f29d4461ca64254cf5960e4c592028ade294b7b4773953bf6a1"; reference:url,publicmosaic.com/indicators; sid:9101992; rev:2;)
alert tls $HOME_NET any -> 108.143.227.46 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"e79db728d3ea047d1290338423dcdd3b68d318c2db4e9fcd6469244685068648"; reference:url,publicmosaic.com/indicators; sid:9100354; rev:2;)
alert tcp $HOME_NET any -> 135.220.199.165 443 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9103316; rev:2;)
alert tls $HOME_NET any -> 137.116.136.69 8443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"c4f341eb6e84ea11ed4cf4d0b3e53cd0f0d42c6d974b25f379469ea58f7c3e52"; reference:url,publicmosaic.com/indicators; sid:9104059; rev:2;)
alert tls $HOME_NET any -> 137.116.136.69 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"d17ccc63c26d18c6060361ea08c9c56bfe279d99430689a32788e88c728a91cc"; reference:url,publicmosaic.com/indicators; sid:9100343; rev:2;)
alert tls $HOME_NET any -> 138.91.32.183 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"d5a01d6b9667e1303c71a89caa5aa8d5f66665d81be7ee4ac7c8c37da734a4bb"; reference:url,publicmosaic.com/indicators; sid:9102248; rev:2;)
alert tls $HOME_NET any -> 158.158.0.196 443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"8050179d4ed123720223e5052a5fa23c1ab6b1939f54ffcde7267b03f8f77a1f"; reference:url,publicmosaic.com/indicators; sid:9100551; rev:2;)
alert tls $HOME_NET any -> 158.158.0.196 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"8567839e0bb75683b1e657021ec35bfb4f824b13b96aee2adaee58906c1b3be0"; reference:url,publicmosaic.com/indicators; sid:9100526; rev:2;)
alert tls $HOME_NET any -> 158.158.17.236 8443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"ecd899384970aeead477859267c00bdb56d67544ea9412127b0204520b983043"; reference:url,publicmosaic.com/indicators; sid:9106736; rev:2;)
alert tls $HOME_NET any -> 158.158.18.61 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"d02d2868493018128dde613e428a2e11274f9d09e40645b4ab523aa2892b7c9d"; reference:url,publicmosaic.com/indicators; sid:9103827; rev:2;)
alert tls $HOME_NET any -> 172.174.29.141 443 (msg:"HOLLOWPOINT exposed tool ligolo"; tls.cert_fingerprint; content:"d66ca9ff5dff583d9fe49230b7a29e835e5b5981cb4d7fa232fd5c213de43c2c"; reference:url,publicmosaic.com/indicators; sid:9101687; rev:2;)
alert tcp $HOME_NET any -> 172.174.128.128 8848 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9101330; rev:2;)
alert tls $HOME_NET any -> 172.174.234.34 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"71768066e848b69f6a362f2f43811aa7199dc1e8042aeb9661f2e25acb9b607c"; reference:url,publicmosaic.com/indicators; sid:9100524; rev:2;)