# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 64 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: asn 9009 — https://publicmosaic.com/asn/9009
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 1
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tls $HOME_NET any -> 37.120.222.88 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"684d959df00af1b4b0242f5846b3d1b54df3b0b61bffbbde7438e7be996c6810"; reference:url,publicmosaic.com/indicators; sid:9106075; rev:2;)
alert tls $HOME_NET any -> 37.120.222.88 56002 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"684d959df00af1b4b0242f5846b3d1b54df3b0b61bffbbde7438e7be996c6810"; reference:url,publicmosaic.com/indicators; sid:9106074; rev:2;)
alert tls $HOME_NET any -> 37.120.222.88 56003 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"684d959df00af1b4b0242f5846b3d1b54df3b0b61bffbbde7438e7be996c6810"; reference:url,publicmosaic.com/indicators; sid:9104688; rev:2;)
alert tls $HOME_NET any -> 38.132.122.141 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"09b63d9c88dd74351d09a452bfa8846128fa45dd72919441e76506a9a0f3214e"; reference:url,publicmosaic.com/indicators; sid:9104068; rev:2;)
alert tls $HOME_NET any -> 38.132.122.141 43211 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"5584b65f331b8cbb1e5edf34dbd1356b14f410ed7396fb890f146ae6ac4736fd"; reference:url,publicmosaic.com/indicators; sid:9103901; rev:2;)
alert tls $HOME_NET any -> 38.132.122.145 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"f408f58ef0693af9b5b5971a7983ef840ede77bad81028cd5d95fd35af5bf52c"; reference:url,publicmosaic.com/indicators; sid:9105014; rev:2;)
alert tls $HOME_NET any -> 38.132.122.145 43211 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"5584b65f331b8cbb1e5edf34dbd1356b14f410ed7396fb890f146ae6ac4736fd"; reference:url,publicmosaic.com/indicators; sid:9104245; rev:2;)
alert tls $HOME_NET any -> 38.132.122.161 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"c6dc0ff23814ae8acfb2ec7f4833d664f43ccdf41a8e73d40043758d54aa9e61"; reference:url,publicmosaic.com/indicators; sid:9103952; rev:2;)
alert tls $HOME_NET any -> 38.132.122.161 43211 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"5584b65f331b8cbb1e5edf34dbd1356b14f410ed7396fb890f146ae6ac4736fd"; reference:url,publicmosaic.com/indicators; sid:9102204; rev:2;)
alert tls $HOME_NET any -> 45.9.249.179 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100218; rev:2;)
alert tls $HOME_NET any -> 45.74.31.54 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"4d2ecd380840c1938a0ece01514b3ef0e9fa37ec33fe10a5afce27385a3b26a9"; reference:url,publicmosaic.com/indicators; sid:9100717; rev:2;)
alert tls $HOME_NET any -> 45.74.31.54 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"0ad9a81f7f300769e307588613a55a8563197229e170ce7e42ea1138d5cb583c"; reference:url,publicmosaic.com/indicators; sid:9100394; rev:2;)
alert tcp $HOME_NET any -> 45.74.34.32 1995 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9101675; rev:2;)
alert tcp $HOME_NET any -> 45.133.180.138 6432 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9105983; rev:2;)
alert tcp $HOME_NET any -> 85.121.245.52 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102912; rev:2;)
alert tls $HOME_NET any -> 89.44.9.164 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"28a3f82abe970277f07e3df989e274d900a7c4867ecedd27d0617f7f00c009f6"; reference:url,publicmosaic.com/indicators; sid:9101304; rev:2;)
alert tcp $HOME_NET any -> 104.250.161.126 2061 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102108; rev:2;)
alert tcp $HOME_NET any -> 134.255.211.140 9300 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106786; rev:2;)
alert tcp $HOME_NET any -> 146.70.49.42 7080 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9105982; rev:2;)
alert tls $HOME_NET any -> 146.70.79.45 8443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"81df444929628e5c96c6ffbe18f59de7015747cb20663857b4bd4658cea4baad"; reference:url,publicmosaic.com/indicators; sid:9104237; rev:2;)
alert tls $HOME_NET any -> 146.70.79.45 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"ab022eddb39549607c97151d39205ebacd4a8816c71bcf23c48774f131172d8e"; reference:url,publicmosaic.com/indicators; sid:9104997; rev:2;)
alert tls $HOME_NET any -> 146.70.87.64 43211 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"5584b65f331b8cbb1e5edf34dbd1356b14f410ed7396fb890f146ae6ac4736fd"; reference:url,publicmosaic.com/indicators; sid:9103364; rev:2;)
alert tls $HOME_NET any -> 146.70.87.96 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"2492351c160e5c1f3e03d93bfacf5a3d987f578efe6b3453d308817e20673edf"; reference:url,publicmosaic.com/indicators; sid:9105688; rev:2;)
alert tls $HOME_NET any -> 146.70.87.96 43211 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"5584b65f331b8cbb1e5edf34dbd1356b14f410ed7396fb890f146ae6ac4736fd"; reference:url,publicmosaic.com/indicators; sid:9103363; rev:2;)
alert tls $HOME_NET any -> 146.70.87.173 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"c2c15101b0048c195cc78d29e4c698c74c05ec55e63ab733446e51d478798cb4"; reference:url,publicmosaic.com/indicators; sid:9106645; rev:2;)
alert tls $HOME_NET any -> 146.70.87.218 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"c4145c0920040c4970463e17682912fd31b022121e3af42d7173b7ee534d7321"; reference:url,publicmosaic.com/indicators; sid:9105689; rev:2;)
alert tls $HOME_NET any -> 146.70.87.237 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"8829c6ec250e512262444c635f0947ffe6c7b7e74e86082ca2b4f8ec879ac80f"; reference:url,publicmosaic.com/indicators; sid:9106192; rev:2;)
alert tls $HOME_NET any -> 146.70.87.237 43211 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"5584b65f331b8cbb1e5edf34dbd1356b14f410ed7396fb890f146ae6ac4736fd"; reference:url,publicmosaic.com/indicators; sid:9103362; rev:2;)
alert tls $HOME_NET any -> 146.70.158.198 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"55b294b42b6b91d6de116c6f60f2cf4e77f9571aea2b4e5bc5c827a9f0b9d3d8"; reference:url,publicmosaic.com/indicators; sid:9100797; rev:2;)
alert tls $HOME_NET any -> 146.70.158.198 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"08dc3a208a3fb829921c63326b680a08e85e2db1b9487d99b9329e8a6fd43aad"; reference:url,publicmosaic.com/indicators; sid:9100333; rev:2;)
alert tls $HOME_NET any -> 146.70.232.107 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"ad9af8c056757580586667da76ade7b3bb043d41aaf4361b55d1252ff4b4d487"; reference:url,publicmosaic.com/indicators; sid:9106744; rev:2;)
alert tls $HOME_NET any -> 146.70.232.107 5093 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"64257fc0fac31c01a5ccd816c73ea86e639260da1604d04db869bb603c2886e6"; reference:url,publicmosaic.com/indicators; sid:9100720; rev:2;)
alert tls $HOME_NET any -> 146.70.232.107 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"be7cbdaf0712389f831ab0e715f9c42b158016a8704ff8ebd57636e5f9b6bb6f"; reference:url,publicmosaic.com/indicators; sid:9106617; rev:2;)
alert tcp $HOME_NET any -> 151.236.20.3 443 (msg:"HOLLOWPOINT C2 adaptix"; reference:url,publicmosaic.com/indicators; sid:9100646; rev:2;)
alert tls $HOME_NET any -> 151.236.20.3 8080 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"5e766519ccb4fc05b7a80543474c81b3366742dd2b9c8a0351a790e0796e2efe"; reference:url,publicmosaic.com/indicators; sid:9100461; rev:2;)
alert tls $HOME_NET any -> 151.236.21.109 2096 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"eb4fe8d8f0727ffe8adcd85213b252b17aa6b2f0390b27599b96948553193ac8"; reference:url,publicmosaic.com/indicators; sid:9105144; rev:2;)
alert tcp $HOME_NET any -> 158.255.213.22 63421 (msg:"HOLLOWPOINT C2 pyramid_c2"; reference:url,publicmosaic.com/indicators; sid:9103792; rev:2;)
alert tcp $HOME_NET any -> 162.252.173.12 8000 (msg:"HOLLOWPOINT C2 pyramid_c2"; reference:url,publicmosaic.com/indicators; sid:9103791; rev:2;)
alert tcp $HOME_NET any -> 172.94.18.103 69 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102102; rev:2;)
alert tcp $HOME_NET any -> 172.94.18.103 70 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102101; rev:2;)
alert tcp $HOME_NET any -> 172.94.18.103 71 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102100; rev:2;)
alert tcp $HOME_NET any -> 172.94.18.103 72 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102099; rev:2;)
alert tcp $HOME_NET any -> 172.94.18.103 73 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102098; rev:2;)
alert tcp $HOME_NET any -> 172.94.18.103 75 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102097; rev:2;)
alert tcp $HOME_NET any -> 172.94.18.103 76 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102096; rev:2;)
alert tcp $HOME_NET any -> 172.94.18.103 77 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102095; rev:2;)
alert tcp $HOME_NET any -> 172.94.18.103 79 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102094; rev:2;)
alert tcp $HOME_NET any -> 172.94.18.103 80 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9106722; rev:2;)
alert tcp $HOME_NET any -> 172.94.18.103 191 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102093; rev:2;)
alert tcp $HOME_NET any -> 172.94.18.198 4782 (msg:"HOLLOWPOINT C2 quasar_rat"; reference:url,publicmosaic.com/indicators; sid:9106560; rev:2;)
alert tls $HOME_NET any -> 172.94.32.132 4782 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"ee705a724fab678259f5e2cae5ddafa2200f4943359c542e96808e8b4b9f5a9d"; reference:url,publicmosaic.com/indicators; sid:9105934; rev:2;)
alert tls $HOME_NET any -> 172.111.143.242 2025 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"dbb4ded7b8471a03f55e2c83ff86ffaafb1f93c7021540d9a727ec14a42b427f"; reference:url,publicmosaic.com/indicators; sid:9101174; rev:2;)
alert tls $HOME_NET any -> 185.9.17.227 4443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"d5697a83e5b99cd02559a6d2b62e9b24bbb9b1cf4b80065d7410c9ccf46017a9"; reference:url,publicmosaic.com/indicators; sid:9101500; rev:2;)
alert tls $HOME_NET any -> 185.9.17.227 8443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"d5697a83e5b99cd02559a6d2b62e9b24bbb9b1cf4b80065d7410c9ccf46017a9"; reference:url,publicmosaic.com/indicators; sid:9101501; rev:2;)
alert tcp $HOME_NET any -> 185.244.212.122 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102673; rev:2;)
alert tcp $HOME_NET any -> 185.244.212.122 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102672; rev:2;)
alert tcp $HOME_NET any -> 185.244.212.122 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102671; rev:2;)
alert tcp $HOME_NET any -> 185.244.212.122 8443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102670; rev:2;)
alert tcp $HOME_NET any -> 185.244.212.122 8591 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105471; rev:2;)
alert tls $HOME_NET any -> 192.36.39.61 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"fbf0342c763a9d741d498d6b48e486975ea0b5998a341f3c340954f97987a079"; reference:url,publicmosaic.com/indicators; sid:9106220; rev:2;)
alert tls $HOME_NET any -> 193.239.85.15 2083 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"e9025bad27db7a56ebf023264b9bc100e14ca5922db1dbbe1eecd73dc9b89d72"; reference:url,publicmosaic.com/indicators; sid:9105142; rev:2;)
alert tls $HOME_NET any -> 193.239.86.192 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"13bf37de8239abb8a59da091445f1fedeb2de35f3fb0c930007b513c7efef161"; reference:url,publicmosaic.com/indicators; sid:9104125; rev:2;)
alert tls $HOME_NET any -> 193.239.86.193 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"13bf37de8239abb8a59da091445f1fedeb2de35f3fb0c930007b513c7efef161"; reference:url,publicmosaic.com/indicators; sid:9104124; rev:2;)
alert tcp $HOME_NET any -> 194.68.26.160 80 (msg:"HOLLOWPOINT C2 adaptix"; reference:url,publicmosaic.com/indicators; sid:9100631; rev:2;)