# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 20 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: asn 979 — https://publicmosaic.com/asn/979
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 2
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tls $HOME_NET any -> 23.148.228.253 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"108c95742d0b35b99eca823730943a62ecf7b8b54681541215ffee75c91926c2"; reference:url,publicmosaic.com/indicators; sid:9103340; rev:2;)
alert tcp $HOME_NET any -> 38.22.95.126 80 (msg:"HOLLOWPOINT C2 flying_eagle"; reference:url,publicmosaic.com/indicators; sid:9101849; rev:2;)
alert tls $HOME_NET any -> 38.95.74.22 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"6c3ca45d8437b90d8fdfe9ee710903309511abceec6561d89ed5dbe470a65041"; reference:url,publicmosaic.com/indicators; sid:9106351; rev:2;)
alert tcp $HOME_NET any -> 64.81.30.37 80 (msg:"HOLLOWPOINT C2 flying_eagle"; reference:url,publicmosaic.com/indicators; sid:9101837; rev:2;)
alert tls $HOME_NET any -> 64.81.30.37 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"9c1d8750541f143c2423aeec1918cafc6b8adee91dad285aafc9e2c50c131d5d"; reference:url,publicmosaic.com/indicators; sid:9101833; rev:2;)
alert tcp $HOME_NET any -> 64.81.114.71 8888 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102938; rev:2;)
alert tcp $HOME_NET any -> 64.83.33.237 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102937; rev:2;)
alert tcp $HOME_NET any -> 64.90.11.106 80 (msg:"HOLLOWPOINT C2 flying_eagle"; reference:url,publicmosaic.com/indicators; sid:9101835; rev:2;)
alert tls $HOME_NET any -> 64.90.27.50 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"ec3c2cad50ea9ff0e8fe8bf4293d287bf53f85fe6765372d9c31e9f57f774b17"; reference:url,publicmosaic.com/indicators; sid:9101834; rev:2;)
alert tls $HOME_NET any -> 64.90.30.189 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"249bf06f36c829e36615a9140e53e273c4af5994fcee668b73c71eb9830c6b8b"; reference:url,publicmosaic.com/indicators; sid:9101831; rev:2;)
alert tls $HOME_NET any -> 64.90.31.240 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"c399c9739fa8838cef44b879f3cc644e657509c215927a3862ed5f7c511624ac"; reference:url,publicmosaic.com/indicators; sid:9106639; rev:2;)
alert tcp $HOME_NET any -> 154.36.163.65 53389 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102337; rev:2;)
alert tcp $HOME_NET any -> 154.36.163.65 63350 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102336; rev:2;)
alert tcp $HOME_NET any -> 154.36.167.198 3000 (msg:"HOLLOWPOINT C2 darksword"; reference:url,publicmosaic.com/indicators; sid:9106804; rev:2;)
alert tcp $HOME_NET any -> 154.37.213.27 8443 (msg:"HOLLOWPOINT C2 havoc"; reference:url,publicmosaic.com/indicators; sid:9100104; rev:2;)
alert tcp $HOME_NET any -> 154.37.218.73 12580 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9100032; rev:2;)
alert tcp $HOME_NET any -> 154.37.218.73 15641 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9103437; rev:2;)
alert tcp $HOME_NET any -> 154.37.218.235 8443 (msg:"HOLLOWPOINT C2 adaptix"; reference:url,publicmosaic.com/indicators; sid:9105343; rev:2;)
alert tcp $HOME_NET any -> 154.64.245.88 15004 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102334; rev:2;)
alert tcp $HOME_NET any -> 154.64.245.88 15005 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102333; rev:2;)