// hollowpoint.yar — generated 2026-09-15 10:08 UTC — 1 rules over 59 hashes — TLP:CLEAR
// source: https://publicmosaic.com/indicators — published for defensive use
// scope: family metasploit-meterpreter — https://publicmosaic.com/c2/metasploit-meterpreter
// basis: hash match only — this site holds no file bytes, so there are no string or byte patterns here.
// A ctype payload hash (a Content-Type claim, not a magic match) is never included.
import "hash"

rule hollowpoint_metasploit_meterpreter_hashes
{
    meta:
        description = "metasploit_meterpreter samples and served payloads observed by the HOLLOWPOINT scanner — hash match only"
        basis = "hash match; no file bytes held"
        provenance = "mined:metsrv"
        reference = "https://publicmosaic.com/c2/metasploit-meterpreter"
        generated = "2026-09-15 10:08 UTC"
        tlp = "clear"
    condition:
        hash.sha256(0, filesize) == "06c21ff77654df8beb1363ea34a91997a60fa77fbfdd48385e2003b6bb677913"
        or hash.sha256(0, filesize) == "16c9db21b6a64cb9fb6aa4d90225d7d5a486e5c55cc0fedd4b6e448a91cf730c"
        or hash.sha256(0, filesize) == "177b108c656abea10345ca9954c1347a7db613625121380e7cef26f3eecb57cc"
        or hash.sha256(0, filesize) == "1c2ecba2c250b6eb296e3517517acb21f670aff5ed40a4ce4ed0d5b65ad648ee"
        or hash.sha256(0, filesize) == "1cf6187e21090c4cf9e90d253e8ac9c26700123693b5e86332d197b267f41a09"
        or hash.sha256(0, filesize) == "1f05ca33de6cb5717f9a755baf74cf23211a3a8b237d49fecb2796d577a46568"
        or hash.sha256(0, filesize) == "218da0d7576835890e22f1b75f14e4f50765ff50cb6c305571b111fa21c31cf1"
        or hash.sha256(0, filesize) == "2199b21dd0104a779ac6cb5bfa5cdb5a09b044d1df8e19f84564131d093efa08"
        or hash.sha256(0, filesize) == "28cfcc3d476c83aa5c84879cb17379a2a0732f85795b3e44db8bdf8b95b069df"
        or hash.sha256(0, filesize) == "2c2092be340185d4ead6fd0516d3d1c864f1583cde9f6c4ad8e6773fe08649a9"
        or hash.sha256(0, filesize) == "2f22e27ec3068d02706d30c8f585fed2d70ad16d7af8c73867faf476584ebe0a"
        or hash.sha256(0, filesize) == "3019d0a8c09a21375108fb01cf77ed435f5c97d3ca2400155ff11703c55997ba"
        or hash.sha256(0, filesize) == "31b9efe33efda936b03e664bd9a6c5f00d7d699ac7179fbc445fc8af6fdc0303"
        or hash.sha256(0, filesize) == "3dbb43545fa3d87ba01d7ebb5f7b633d891603556686e0e76cb3fffc6c95f17a"
        or hash.sha256(0, filesize) == "3dccd3ce19d6d6ac7defaabbd1e1f1024b90adaafaaa3c99edf2a3be74008214"
        or hash.sha256(0, filesize) == "3f51d15ad5c205f964200573364eb0b13b8658020d7c889d833cb13cf1ca54a6"
        or hash.sha256(0, filesize) == "40413f8cdb24ad8c4504f06c519ccd5bb1009a3adbdb38b6a793326891f09775"
        or hash.sha256(0, filesize) == "415b1597e6eeecdc86b39be20547983cd499196c29a66dfa3bf2d5c766d6c29b"
        or hash.sha256(0, filesize) == "4400721266ac80a25bda87147abb976e6a1293d86e933636129e07bdfe2888e9"
        or hash.sha256(0, filesize) == "6426ff20758127e6fcdcdb0b4a2b857152e79e3789edeb3101c2a045077736c8"
        or hash.sha256(0, filesize) == "69a1d19e7a5769b52f025ae3c5c3c9e5eee2e110b0a550535df463f39651a3df"
        or hash.sha256(0, filesize) == "6c69194de1598713cf4ae3f3f91b1db6678434f26f6f927865ca37102bfbc48a"
        or hash.sha256(0, filesize) == "6d94b1566e45a3c19246c5348740ddf881e476f5411537771117f8be033bed37"
        or hash.sha256(0, filesize) == "71e156c74ce3924e2c1b88e7da79196b6863bed433450282052136d171fb857f"
        or hash.sha256(0, filesize) == "78ddd8abc37bffbda841f8373e7a8f46215888ff85989e6873483dd65689825c"
        or hash.sha256(0, filesize) == "7d34a52f8542c7b1cfbac5a378d1568bbc3b4b3a9d7fce099c699e405060ca71"
        or hash.sha256(0, filesize) == "8025c7c934f2f30f4aaa4be55c3aafdec5d9f93e742f3f4729c677b1ad8e3302"
        or hash.sha256(0, filesize) == "835a01f4425fbcb407370475105348e4aadc2ff8c89556f878eb1da521c8c64a"
        or hash.sha256(0, filesize) == "853565e93a6fe826c7bacd7aece876dd4fa9b3742b2a968f9d2e79d9393da932"
        or hash.sha256(0, filesize) == "85aaa6ccc281c94329779e4968c548b37fc28a786a8e7bd57552c4ab3e66ce63"
        or hash.sha256(0, filesize) == "866276da8d2ed995e38fd23d6fed4a64683c0e71cb45d18531f7f3ecbe780442"
        or hash.sha256(0, filesize) == "8a62210944249376ae6252a41263067624ecb4123ba8ce42d0b6cacb0b704697"
        or hash.sha256(0, filesize) == "91b75766854c825ea9dcc841d6acfdb38df377964ac8e5a8a3df1d7a564d41a7"
        or hash.sha256(0, filesize) == "941b34e2e558090bd0e54ee3a5768e34e00e2a2927aed3fa975cf6309e9493c4"
        or hash.sha256(0, filesize) == "9e4a744997804249a2b702c9cab3b2a629a29fe9f922ec1b6871d12522d17a62"
        or hash.sha256(0, filesize) == "a550473ff5f314b343552f30a17c5728ffe6ea2bc180e45b0513a9727e9fdb85"
        or hash.sha256(0, filesize) == "a9a755d4d921ee47fbd7d840610fa21626aa6a2803a68944fff05a3616278a11"
        or hash.sha256(0, filesize) == "b0747d8196edf6e4af60f1e45722ba8e3ad37040589bd223cda134401cb9b35d"
        or hash.sha256(0, filesize) == "b2b5e0072a0b8ed8bc81c864f171187ef2542b59fd64741b4191d4c8c8051962"
        or hash.sha256(0, filesize) == "b5fe59769609bb98fa151d5fa417a7ba4f188822666cfedaa004151771f7b74c"
        or hash.sha256(0, filesize) == "b80885820e8491f34a35ce00f048df021f794824dc75eb1ec25cbf153ce263f5"
        or hash.sha256(0, filesize) == "bfbb8573dda444d3eb47184855c9a55e592ed80a500dbba7cf30aa10bfc5b724"
        or hash.sha256(0, filesize) == "c07a84df3882e3abebf62654ae073d6f77e2ccb1b99b3ff15779dfd60af5d1a3"
        or hash.sha256(0, filesize) == "c6759ee79bedd82ccc83b94997c53264787c5bd733f8156fd6ae22c047728bba"
        or hash.sha256(0, filesize) == "c8caf4b9168db39a51ce6b26b7000dcbe73fc18c984a41833233b9b1583fa5fa"
        or hash.sha256(0, filesize) == "caecfba2ec9d427abae5c71a12116a80ec93084c9b027fef7e70d5a6925eb71c"
        or hash.sha256(0, filesize) == "d1cc3cad465ba68a0fa63edbfdfa80b249a54669600722367ac8fa3d4d57d92d"
        or hash.sha256(0, filesize) == "d353fad26aba0918825597c469e613fc5c6acf5778ecc3fdd1ba04874d912167"
        or hash.sha256(0, filesize) == "d4d7abc9692a532ee1f9a3be94e2c9ad300eb35e64a4f868638debd2f239e1c7"
        or hash.sha256(0, filesize) == "d7018cec443d6b3a21492bb02fc4bbe044e4990320f102bde20ed5cdd1154b16"
        or hash.sha256(0, filesize) == "d819274e8ca422643cbbd9ac68045fc7e091e5243207840d1cc43bd488ad70a2"
        or hash.sha256(0, filesize) == "d9b9ea607a3e75a10916bcf6308da8829e7eb2d7e0639bcb79074bb9161e1363"
        or hash.sha256(0, filesize) == "dfd1e0412550a7f7083c42a281df5c388af448aa4aafd0b7721778b14eb9afaa"
        or hash.sha256(0, filesize) == "e05130bdfa912f9f4ca08fc865574c8f1affe6b39d1b3a5023d08e98b1f4622b"
        or hash.sha256(0, filesize) == "ecf26dd059c471b41dc6bab3ccb9c4f03cfea34d520d3ddb5d7992b0b677dfe1"
        or hash.sha256(0, filesize) == "f1565d76f0be87cdfb8b8c220bfed460957e5b45ef27371c0f3d4211f312af8e"
        or hash.sha256(0, filesize) == "f1ee3c4fbd8523143fdffb58c991684dd0ae04f2483174c935f2c03eacf56e54"
        or hash.sha256(0, filesize) == "f7fc1b7c3ccc03af9372f7ddcd181ff7289dbe99c7d3114a7c3e71ce5b836330"
        or hash.sha256(0, filesize) == "f9fb7c9533682dba0ad71ac33b8d5e5cd195540eee217dc19425161df9e1d77b"
}