# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 84 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: family havoc — https://publicmosaic.com/c2/havoc
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 1
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tls $HOME_NET any -> 2.88.92.98 443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"19890bf6add5d54a582a980457347e7b82c86ac08dd1b63cc1b52b2370a6405c"; reference:url,publicmosaic.com/indicators; sid:9100429; rev:2;)
alert tls $HOME_NET any -> 2.91.182.143 443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"53e252a76dbd386ab936f4101ed3bf3c4dbde784d09e8d4e35dd9732be7ca0ea"; reference:url,publicmosaic.com/indicators; sid:9104045; rev:2;)
alert tls $HOME_NET any -> 2.91.185.72 443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"145095cbd4d76af347795c463f105b319595cbfb757d2b48b41357498cea6170"; reference:url,publicmosaic.com/indicators; sid:9101326; rev:2;)
alert tls $HOME_NET any -> 3.39.249.68 40056 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"ecccb50c92d8465b5c037c0f2505ee8767326e544d90021723d34d1a653c4831"; reference:url,publicmosaic.com/indicators; sid:9103975; rev:2;)
alert tcp $HOME_NET any -> 4.193.136.143 80 (msg:"HOLLOWPOINT C2 havoc"; reference:url,publicmosaic.com/indicators; sid:9100583; rev:2;)
alert tls $HOME_NET any -> 4.193.136.143 443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"98dfe4210517e50c68c6e82157f7d99cc41d012b29bff1d46fc53eb8dcb16927"; reference:url,publicmosaic.com/indicators; sid:9100569; rev:2;)
alert tcp $HOME_NET any -> 8.147.114.203 443 (msg:"HOLLOWPOINT C2 havoc"; reference:url,publicmosaic.com/indicators; sid:9104447; rev:2;)
alert tcp $HOME_NET any -> 15.204.14.143 80 (msg:"HOLLOWPOINT C2 havoc"; reference:url,publicmosaic.com/indicators; sid:9100582; rev:2;)
alert tcp $HOME_NET any -> 15.204.14.143 443 (msg:"HOLLOWPOINT C2 havoc"; reference:url,publicmosaic.com/indicators; sid:9100566; rev:2;)
alert tls $HOME_NET any -> 15.204.14.143 40056 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"50037c0fdb26afebef03491c5fbd827dc9544772c85f817b235b2882f48eacbb"; reference:url,publicmosaic.com/indicators; sid:9104159; rev:2;)
alert tcp $HOME_NET any -> 15.204.95.228 80 (msg:"HOLLOWPOINT C2 havoc"; reference:url,publicmosaic.com/indicators; sid:9100573; rev:2;)
alert tcp $HOME_NET any -> 15.204.95.228 443 (msg:"HOLLOWPOINT C2 havoc"; reference:url,publicmosaic.com/indicators; sid:9100568; rev:2;)
alert tls $HOME_NET any -> 15.204.95.228 40056 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"50037c0fdb26afebef03491c5fbd827dc9544772c85f817b235b2882f48eacbb"; reference:url,publicmosaic.com/indicators; sid:9103955; rev:2;)
alert tls $HOME_NET any -> 16.5.7.159 443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"b7c7fd53a74c65d78e6a8f1d2961e84ae868edd7be4c5fc04c9a08c0ffee7671"; reference:url,publicmosaic.com/indicators; sid:9106735; rev:2;)
alert tls $HOME_NET any -> 18.97.21.97 40056 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"31aeea6f8aebf50060f3c88be6a5db22048624cf61306b58e0a184402729d1b3"; reference:url,publicmosaic.com/indicators; sid:9104221; rev:2;)
alert tls $HOME_NET any -> 18.97.21.97 57043 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"2ebfe6001235c77f2c59b0774ad241d8073d4359ceb43323c76c2183cf0307f5"; reference:url,publicmosaic.com/indicators; sid:9103350; rev:2;)
alert tls $HOME_NET any -> 18.97.21.97 57143 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"cad765038b0c7f7d02f65ac91600e61bebd301f927372ba870993f0ba97e9195"; reference:url,publicmosaic.com/indicators; sid:9103349; rev:2;)
alert tcp $HOME_NET any -> 18.171.190.112 8080 (msg:"HOLLOWPOINT C2 havoc"; reference:url,publicmosaic.com/indicators; sid:9104081; rev:2;)
alert tls $HOME_NET any -> 20.2.140.201 8443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"e52ce0cb37e4e5eb28ffb7be345fb72158701d801f0907f1104659eacf73b75d"; reference:url,publicmosaic.com/indicators; sid:9103896; rev:2;)
alert tls $HOME_NET any -> 20.2.140.201 40056 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"96ec4421ae52bc0763d58b769aee1941870407f0e62fc57254dcf5cf181e3c1c"; reference:url,publicmosaic.com/indicators; sid:9104180; rev:2;)
alert tls $HOME_NET any -> 20.39.60.137 443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"0cfcc6df36b4da5e87c2ae5a78a367c2defc46283d4bf49dab9fa1e26a8c108c"; reference:url,publicmosaic.com/indicators; sid:9100562; rev:2;)
alert tcp $HOME_NET any -> 35.179.229.71 80 (msg:"HOLLOWPOINT C2 havoc"; reference:url,publicmosaic.com/indicators; sid:9100574; rev:2;)
alert tcp $HOME_NET any -> 37.235.54.142 53236 (msg:"HOLLOWPOINT C2 havoc"; reference:url,publicmosaic.com/indicators; sid:9104488; rev:2;)
alert tls $HOME_NET any -> 43.134.42.247 443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"11290ba2ec7a171b4afecda0d1095855df241063af5d51e246df177911f37e21"; reference:url,publicmosaic.com/indicators; sid:9100581; rev:2;)
alert tls $HOME_NET any -> 46.63.0.187 443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"f751b21df7806aa20a78239ecd735b75a88b8b415129baa9b9a817134e398517"; reference:url,publicmosaic.com/indicators; sid:9100770; rev:2;)
alert tls $HOME_NET any -> 47.83.134.97 443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"300f4dbaffabc44715dd7f4a1ffb4b04cc367cf27ef2cda7eba5a210bd902693"; reference:url,publicmosaic.com/indicators; sid:9100576; rev:2;)
alert tls $HOME_NET any -> 49.232.135.25 443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"6c90ed256aa5b8249f59cfcfe3bff5902780afa2f02f713dcdc3221ab25f2dca"; reference:url,publicmosaic.com/indicators; sid:9100768; rev:2;)
alert tcp $HOME_NET any -> 49.232.135.25 8080 (msg:"HOLLOWPOINT C2 havoc"; reference:url,publicmosaic.com/indicators; sid:9100141; rev:2;)
alert tls $HOME_NET any -> 50.60.157.152 443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"badde35bcc382152dbe73a1ad6fbec99d0206712971ad201c6a350f132d64301"; reference:url,publicmosaic.com/indicators; sid:9105657; rev:2;)
alert tcp $HOME_NET any -> 51.81.171.234 80 (msg:"HOLLOWPOINT C2 havoc"; reference:url,publicmosaic.com/indicators; sid:9100571; rev:2;)
alert tcp $HOME_NET any -> 51.81.171.234 443 (msg:"HOLLOWPOINT C2 havoc"; reference:url,publicmosaic.com/indicators; sid:9100577; rev:2;)
alert tls $HOME_NET any -> 51.81.171.234 40056 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"50037c0fdb26afebef03491c5fbd827dc9544772c85f817b235b2882f48eacbb"; reference:url,publicmosaic.com/indicators; sid:9104163; rev:2;)
alert tcp $HOME_NET any -> 54.95.208.190 80 (msg:"HOLLOWPOINT C2 havoc"; reference:url,publicmosaic.com/indicators; sid:9101504; rev:2;)
alert tls $HOME_NET any -> 54.95.208.190 443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"a8eea2c59a3ecd38b6bad14800d9c1711afc8ad86c2a99c0ce93e9eaf4e86c32"; reference:url,publicmosaic.com/indicators; sid:9100701; rev:2;)
alert tcp $HOME_NET any -> 54.247.42.8 80 (msg:"HOLLOWPOINT C2 havoc"; reference:url,publicmosaic.com/indicators; sid:9106559; rev:2;)
alert tls $HOME_NET any -> 66.78.40.93 443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"37dc207b42768ce5b842d2dadab6a356c6c331ef37bb3d04071c3db2b23dab54"; reference:url,publicmosaic.com/indicators; sid:9105817; rev:2;)
alert tls $HOME_NET any -> 68.178.205.17 40056 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"cdb306499f0da4400436c6c2e89aa80ee0cddbab9739931bef3c95d1e0f4b9c5"; reference:url,publicmosaic.com/indicators; sid:9100736; rev:2;)
alert tls $HOME_NET any -> 68.183.248.32 4443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"9230c9fa48d68de48c55faccdf1d5547c3794752e5b2965406dd4e8cc139f884"; reference:url,publicmosaic.com/indicators; sid:9104194; rev:2;)
alert tls $HOME_NET any -> 82.156.224.184 40056 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"77e6db88c612b5dce6a78c88cf97079746a60158c704a1c799849d7a782eb357"; reference:url,publicmosaic.com/indicators; sid:9103954; rev:2;)
alert tcp $HOME_NET any -> 85.9.199.115 8443 (msg:"HOLLOWPOINT C2 havoc"; reference:url,publicmosaic.com/indicators; sid:9105288; rev:2;)
alert tcp $HOME_NET any -> 85.9.199.115 8888 (msg:"HOLLOWPOINT C2 havoc"; reference:url,publicmosaic.com/indicators; sid:9105287; rev:2;)
alert tls $HOME_NET any -> 89.125.48.185 443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"7dc5f95c8212072c1f1d598c56295624a7e32dae7508243a96980124a40e3860"; reference:url,publicmosaic.com/indicators; sid:9104165; rev:2;)
alert tls $HOME_NET any -> 89.125.48.185 40056 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"6502a2b0ebf21e29b19ddc3660c0144f7e1f6a6d3c9e152b958047dff1dfc64c"; reference:url,publicmosaic.com/indicators; sid:9104164; rev:2;)
alert tls $HOME_NET any -> 93.152.223.39 28447 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"240cdb3066a31fabf92a2e2dba34e6e526f1bee92023e86e73ffc7cfcec9848e"; reference:url,publicmosaic.com/indicators; sid:9100034; rev:2;)
alert tcp $HOME_NET any -> 95.133.166.10 80 (msg:"HOLLOWPOINT C2 havoc"; reference:url,publicmosaic.com/indicators; sid:9101503; rev:2;)
alert tcp $HOME_NET any -> 104.248.156.16 80 (msg:"HOLLOWPOINT C2 havoc"; reference:url,publicmosaic.com/indicators; sid:9106834; rev:2;)
alert tls $HOME_NET any -> 104.248.156.16 443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"5ed089289ea8b3ced194bbfbf59795a1c2ba512cab77d93f16d690b16a589a02"; reference:url,publicmosaic.com/indicators; sid:9106390; rev:2;)
alert tls $HOME_NET any -> 104.248.156.16 40056 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"0857c9e7d25a6fbc8b269c3bc476a9d37e6de8b381818beb0ea3a689504d8b06"; reference:url,publicmosaic.com/indicators; sid:9106833; rev:2;)
alert tcp $HOME_NET any -> 107.172.22.3 443 (msg:"HOLLOWPOINT C2 havoc"; reference:url,publicmosaic.com/indicators; sid:9100579; rev:2;)
alert tls $HOME_NET any -> 107.172.22.3 8888 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"17cf0c9c1af832741de83acb9817e35438c2afa5be09a494c415ae222f3cd6b2"; reference:url,publicmosaic.com/indicators; sid:9103953; rev:2;)
alert tls $HOME_NET any -> 124.220.55.95 23333 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"a19ea9e0f98ad7222d21cab2ab539730ed7e2c9f4005f43bc5ea3f7ea1604996"; reference:url,publicmosaic.com/indicators; sid:9103779; rev:2;)
alert tls $HOME_NET any -> 124.221.215.82 40056 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"b9942d1fe1b0e462194b835b46d959a0c6b00844c604b32ee114c965afa1c32e"; reference:url,publicmosaic.com/indicators; sid:9100747; rev:2;)
alert tls $HOME_NET any -> 142.93.88.220 443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"69755dc2542b7d7e2117744751933553c615c877be7df0ede6f4fff41b8176ce"; reference:url,publicmosaic.com/indicators; sid:9100578; rev:2;)
alert tcp $HOME_NET any -> 143.198.120.167 80 (msg:"HOLLOWPOINT C2 havoc"; reference:url,publicmosaic.com/indicators; sid:9100575; rev:2;)
alert tls $HOME_NET any -> 143.198.120.167 40056 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"bd30c1c4afd5950d0eb41777c07a167f7edfeccf037eae20b19d6d5435522584"; reference:url,publicmosaic.com/indicators; sid:9105681; rev:2;)
alert tls $HOME_NET any -> 146.190.80.105 443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"28af1dad02e5edf428670e964dccbe0882e181480321f0f3c311dcdde4e94ca4"; reference:url,publicmosaic.com/indicators; sid:9100567; rev:2;)
alert tls $HOME_NET any -> 146.190.80.105 40056 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"d786e9d07d111f586b8312a6c411917ce0d3810f2ea6f510c70aaad2bae13287"; reference:url,publicmosaic.com/indicators; sid:9105680; rev:2;)
alert tls $HOME_NET any -> 151.236.21.109 2096 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"eb4fe8d8f0727ffe8adcd85213b252b17aa6b2f0390b27599b96948553193ac8"; reference:url,publicmosaic.com/indicators; sid:9105144; rev:2;)
alert tcp $HOME_NET any -> 154.37.213.27 8443 (msg:"HOLLOWPOINT C2 havoc"; reference:url,publicmosaic.com/indicators; sid:9100104; rev:2;)
alert tls $HOME_NET any -> 154.46.30.12 443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"8a10c904aa70a37961bd0bee0347046ffedeb73546e288db3a5cf94519feb2c3"; reference:url,publicmosaic.com/indicators; sid:9106558; rev:2;)
alert tls $HOME_NET any -> 154.205.145.109 2096 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"dbe90fd89cbee0bf150ba06ce226ddcf817caca14991bd188484da3368311abe"; reference:url,publicmosaic.com/indicators; sid:9105143; rev:2;)
alert tls $HOME_NET any -> 159.89.192.91 8080 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"612c0dd896261c396ce44d31dec8f53178ff3cbb119591b11dcdfd3eac9e6605"; reference:url,publicmosaic.com/indicators; sid:9104225; rev:2;)
alert tls $HOME_NET any -> 161.35.176.231 443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"b1932d33e37714b4c4324e14dfda74c748dfd8d2ff7fe0fbf66dfa3f0f970d10"; reference:url,publicmosaic.com/indicators; sid:9100570; rev:2;)
alert tls $HOME_NET any -> 161.35.239.147 443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"a2321717f2062d34b83832b83c3c29cdf370edfa6a40b6ddfd57491b586d6ad4"; reference:url,publicmosaic.com/indicators; sid:9100572; rev:2;)
alert tls $HOME_NET any -> 161.35.239.147 40056 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"863fed66ddcf7293d547ee6017c85c54e531c0dd3ac5a59ce96e9f4f5be3b266"; reference:url,publicmosaic.com/indicators; sid:9105679; rev:2;)
alert tls $HOME_NET any -> 162.243.160.70 8443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"cd78457626be98c8a75fe00a9d5aeabacc432cebbb5b52938cdfabf9aca6514f"; reference:url,publicmosaic.com/indicators; sid:9101333; rev:2;)
alert tls $HOME_NET any -> 164.92.79.49 443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"990b474bcd6acb29d89ebc84735234752dfd9c4eda14fce659afdf02177b7ed0"; reference:url,publicmosaic.com/indicators; sid:9100565; rev:2;)
alert tcp $HOME_NET any -> 164.132.104.177 80 (msg:"HOLLOWPOINT C2 havoc"; reference:url,publicmosaic.com/indicators; sid:9103875; rev:2;)
alert tls $HOME_NET any -> 167.172.142.69 443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"561263fe6c1059e3231a46eb234b8aa7aceef27ee5097e7f6289d80ce38fd843"; reference:url,publicmosaic.com/indicators; sid:9106189; rev:2;)
alert tls $HOME_NET any -> 172.239.45.42 81 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"6b64a81be95746ba51510915028942acc29971d14f53604e05c9a05f079568dd"; reference:url,publicmosaic.com/indicators; sid:9100691; rev:2;)
alert tcp $HOME_NET any -> 173.249.41.141 80 (msg:"HOLLOWPOINT C2 havoc"; reference:url,publicmosaic.com/indicators; sid:9100564; rev:2;)
alert tls $HOME_NET any -> 173.249.41.141 40056 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"415603450366b957da78b16b8a34353ca0c5d4d5a7f35d2f4f758d7e106f480e"; reference:url,publicmosaic.com/indicators; sid:9105677; rev:2;)
alert tls $HOME_NET any -> 178.128.14.67 4443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"9230c9fa48d68de48c55faccdf1d5547c3794752e5b2965406dd4e8cc139f884"; reference:url,publicmosaic.com/indicators; sid:9104487; rev:2;)
alert tcp $HOME_NET any -> 185.130.45.240 80 (msg:"HOLLOWPOINT C2 havoc"; reference:url,publicmosaic.com/indicators; sid:9101502; rev:2;)
alert tls $HOME_NET any -> 191.252.184.198 1080 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"28edfc9ff0f962b50d47df3c9952157d2d3e6d11c725226496b1bca14be28dcf"; reference:url,publicmosaic.com/indicators; sid:9104994; rev:2;)
alert tls $HOME_NET any -> 191.252.184.198 1337 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"ef18d58b2c46dc0b0c80a28d7e8b5a8600855a9130cb35a5a300eb6b156f0797"; reference:url,publicmosaic.com/indicators; sid:9100080; rev:2;)
alert tcp $HOME_NET any -> 192.169.176.54 449 (msg:"HOLLOWPOINT C2 havoc"; reference:url,publicmosaic.com/indicators; sid:9100563; rev:2;)
alert tls $HOME_NET any -> 192.169.176.54 40056 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"cdb306499f0da4400436c6c2e89aa80ee0cddbab9739931bef3c95d1e0f4b9c5"; reference:url,publicmosaic.com/indicators; sid:9100745; rev:2;)
alert tls $HOME_NET any -> 193.239.85.15 2083 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"e9025bad27db7a56ebf023264b9bc100e14ca5922db1dbbe1eecd73dc9b89d72"; reference:url,publicmosaic.com/indicators; sid:9105142; rev:2;)
alert tls $HOME_NET any -> 206.81.21.156 40056 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"3d56aadb7101660dd84db7627acc4e908046f6f9514ea0a630deedb1cc0545db"; reference:url,publicmosaic.com/indicators; sid:9100743; rev:2;)
alert tls $HOME_NET any -> 210.2.169.213 443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"314bf0f2c8a1f96e82fa91803bf7dea1dfb465fa2c54d47590a93dd97a60cdfe"; reference:url,publicmosaic.com/indicators; sid:9103661; rev:2;)
alert tcp $HOME_NET any -> 212.46.38.117 4445 (msg:"HOLLOWPOINT C2 havoc"; reference:url,publicmosaic.com/indicators; sid:9103348; rev:2;)
alert tls $HOME_NET any -> 212.103.26.10 55000 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"010bcd85f0372f86c52b204355df1ebbee8e3eb5e3b32119856486be03637c9e"; reference:url,publicmosaic.com/indicators; sid:9103347; rev:2;)
alert tls $HOME_NET any -> 217.217.97.164 8443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"1e94951363eb2bd3555aba2f80d0372c0276ad53ef3519730dc3097168135b4b"; reference:url,publicmosaic.com/indicators; sid:9100064; rev:2;)