# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 127 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: family mythic — https://publicmosaic.com/c2/mythic
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 0
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tls $HOME_NET any -> 2.27.202.130 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"de7ad7c39c740718add77aa574e5c07c1093a764edeec2daa97aec1c027e345f"; reference:url,publicmosaic.com/indicators; sid:9100160; rev:2;)
alert tls $HOME_NET any -> 3.6.16.126 443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"cd12eb84a86f7b392fb12b7c92ca538e88a83373e429b5936aabe0d6d1169113"; reference:url,publicmosaic.com/indicators; sid:9106468; rev:2;)
alert tls $HOME_NET any -> 3.121.234.29 443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"7d950f2d3db82858a7a8a908c2b89ece0539c5ac6f23332504417c680deeb379"; reference:url,publicmosaic.com/indicators; sid:9100561; rev:2;)
alert tls $HOME_NET any -> 3.143.55.137 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"b3427b436c7a324889134bd23a42e8479b6263e4716c0934e22fd9cd04a2a4ec"; reference:url,publicmosaic.com/indicators; sid:9103778; rev:2;)
alert tls $HOME_NET any -> 13.205.33.34 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"7e9df8e58f071617186ad7d6ca108b28aa35c5028eb87b0d104a1d34a1b0bbe1"; reference:url,publicmosaic.com/indicators; sid:9100787; rev:2;)
alert tls $HOME_NET any -> 15.168.12.234 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"1e68003c2c18cf29489913cbfd9ae62b47c8d6c7d166fcb9bdf3858556b2a1a5"; reference:url,publicmosaic.com/indicators; sid:9104690; rev:2;)
alert tls $HOME_NET any -> 15.235.204.60 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"017342a153aecc3932b5ab1891b40846a9bd513e257a6619006ffca3f1580fa2"; reference:url,publicmosaic.com/indicators; sid:9105678; rev:2;)
alert tls $HOME_NET any -> 20.2.87.168 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"f586e806f6bf76543d46f2cab20d11044407fe1a9ee34b85443431ef88453c4d"; reference:url,publicmosaic.com/indicators; sid:9100543; rev:2;)
alert tls $HOME_NET any -> 20.74.145.114 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"9b74ce41c17154e9c12630fde77a61153a4e4de5eaef5247c47ce5fc01247d6d"; reference:url,publicmosaic.com/indicators; sid:9100159; rev:2;)
alert tls $HOME_NET any -> 20.115.227.161 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"d88dc741bc13d14a0e4669ddb6efe453df0c058ddaaa627001070421f8d6088c"; reference:url,publicmosaic.com/indicators; sid:9100072; rev:2;)
alert tls $HOME_NET any -> 20.200.61.22 443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"50e6418c8f0f46d3a685706c1aedf9baf77c136c5af78921a6ff3160a19049ed"; reference:url,publicmosaic.com/indicators; sid:9100545; rev:2;)
alert tls $HOME_NET any -> 23.148.228.253 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"108c95742d0b35b99eca823730943a62ecf7b8b54681541215ffee75c91926c2"; reference:url,publicmosaic.com/indicators; sid:9103340; rev:2;)
alert tls $HOME_NET any -> 31.77.145.53 4443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"f7c9d511a1383c72ecf57b83df0bf7147490e8751b6a5f5eb69f30f5d55b4126"; reference:url,publicmosaic.com/indicators; sid:9100560; rev:2;)
alert tls $HOME_NET any -> 31.77.145.53 4444 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"0f385de0bad6d829bc754030280a52a6302c0a3f0fb015f3047f40aa542616d5"; reference:url,publicmosaic.com/indicators; sid:9100550; rev:2;)
alert tls $HOME_NET any -> 31.171.131.250 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"fe92d246a7cab7e178239347767ecd22e44190022a73bbac02c9f5f4b38007fa"; reference:url,publicmosaic.com/indicators; sid:9100808; rev:2;)
alert tls $HOME_NET any -> 34.24.127.255 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"3ce35033240e4dcffa9c05a5c5a20dfd8e3f7c5277fe748ebae77f81d36f3982"; reference:url,publicmosaic.com/indicators; sid:9100155; rev:2;)
alert tls $HOME_NET any -> 34.134.117.89 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"5d4c0f9c90a16c6fe1f273307be9d4d7af4f65d63682a8f9593b76e0ee6b5c72"; reference:url,publicmosaic.com/indicators; sid:9106076; rev:2;)
alert tls $HOME_NET any -> 34.150.91.139 443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"05ab52a87640ad42b9b999768e8e106e5c61959a4f27f530fa087bcadeecf677"; reference:url,publicmosaic.com/indicators; sid:9100540; rev:2;)
alert tls $HOME_NET any -> 37.72.168.212 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"c7c51cf3c519e013d78ac2e2b463c184b5bdbab2a13bd6a0441619c59dc0f6f1"; reference:url,publicmosaic.com/indicators; sid:9100542; rev:2;)
alert tls $HOME_NET any -> 38.207.177.71 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"994927dd1b28be4a7fea776ceebf1e37863266bfdff6a4a845fd616864da955e"; reference:url,publicmosaic.com/indicators; sid:9100541; rev:2;)
alert tls $HOME_NET any -> 43.133.164.200 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"5f9568d3ba8cb22b55d2b5359eb13e217cf6676f1717c8c05f951b5ba8218b0c"; reference:url,publicmosaic.com/indicators; sid:9100152; rev:2;)
alert tls $HOME_NET any -> 43.133.164.200 9090 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"82b17ac2aa869842cc9b9b3406c14229e590d571d470400cff897b8ff00fa9ab"; reference:url,publicmosaic.com/indicators; sid:9101727; rev:2;)
alert tls $HOME_NET any -> 43.133.165.151 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"41b176a60667cd95e7c47481cfb9e605dc9965f475550b6df6b6a12722e64965"; reference:url,publicmosaic.com/indicators; sid:9100728; rev:2;)
alert tls $HOME_NET any -> 43.134.38.218 4543 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"8fa6b8b4af3a62adafafe4cc1605596fdbe9d52d3458b18c63c9043af2b51e5f"; reference:url,publicmosaic.com/indicators; sid:9103339; rev:2;)
alert tls $HOME_NET any -> 45.61.170.105 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"d72bd62a0ec70026f80e5d4b59c231096b482d6a24499ab756a6db3bd650ad72"; reference:url,publicmosaic.com/indicators; sid:9100145; rev:2;)
alert tls $HOME_NET any -> 45.92.158.150 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"f449dc4279a80d763da0b6f76d18ec685809546ee94311b07aaa4f7a00976288"; reference:url,publicmosaic.com/indicators; sid:9106059; rev:2;)
alert tls $HOME_NET any -> 45.158.116.86 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"ecb709d84a940032af26e3d32caf9315db7a87005aa1fab14ef3a68123edf915"; reference:url,publicmosaic.com/indicators; sid:9103874; rev:2;)
alert tls $HOME_NET any -> 47.87.84.177 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"dfa6d06646a8c4625224a104d45f90bfa5b1fd6c27ea9ed86f854c40aeb432f4"; reference:url,publicmosaic.com/indicators; sid:9100539; rev:2;)
alert tls $HOME_NET any -> 47.239.61.167 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"1c9312227b077be0f1ccfccff05ceb0276c0815349b39568b856f0982a47b23b"; reference:url,publicmosaic.com/indicators; sid:9104683; rev:2;)
alert tls $HOME_NET any -> 54.145.56.188 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"53c64405646bc3d7070ed0456eec4e8721cafd8cc3338505cf1fe9d0a1a7fba8"; reference:url,publicmosaic.com/indicators; sid:9103777; rev:2;)
alert tls $HOME_NET any -> 54.187.35.128 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"91ee899c99adcf76d222d0a2ed1b458305b475be78879e450466a49a3c496ef2"; reference:url,publicmosaic.com/indicators; sid:9103776; rev:2;)
alert tls $HOME_NET any -> 62.4.0.66 443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"10050f2860df0f8b7d0e736ee4d83643a5fdc0a86130e8db76faf1c43e67bcc4"; reference:url,publicmosaic.com/indicators; sid:9100559; rev:2;)
alert tls $HOME_NET any -> 62.4.0.66 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"0f676ded90e0b10da264f202674ccc78dba7ce1b0c2e6b6637005ea9436ca1ef"; reference:url,publicmosaic.com/indicators; sid:9100538; rev:2;)
alert tls $HOME_NET any -> 62.238.110.216 443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"0f385de0bad6d829bc754030280a52a6302c0a3f0fb015f3047f40aa542616d5"; reference:url,publicmosaic.com/indicators; sid:9101635; rev:2;)
alert tls $HOME_NET any -> 64.89.162.117 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"b024bb754dcaa3955425ffaaf63abf89ee369dd8baede0c854ff606da5e2f17a"; reference:url,publicmosaic.com/indicators; sid:9100537; rev:2;)
alert tls $HOME_NET any -> 64.118.140.156 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"ba4b7932e4302e0804558c1cfd4e958a4ea0a94b58361bc2f6eda9b48b2f583c"; reference:url,publicmosaic.com/indicators; sid:9100424; rev:2;)
alert tls $HOME_NET any -> 64.227.105.70 8080 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"7b0e3a0a7348caef577425a26dac71ce950e1f57cc63f3ce1a23cc8623a2699c"; reference:url,publicmosaic.com/indicators; sid:9100558; rev:2;)
alert tls $HOME_NET any -> 64.227.159.29 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"43bf4be099211389e2e4da6d77943117243331343661de2bd6932043fa9ad229"; reference:url,publicmosaic.com/indicators; sid:9100536; rev:2;)
alert tls $HOME_NET any -> 65.87.7.11 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"498d0014fae64634d5372ed5410a0855ba45ed1a1e8c6557c849c18295188927"; reference:url,publicmosaic.com/indicators; sid:9106455; rev:2;)
alert tls $HOME_NET any -> 68.178.202.150 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"7b8c524de52d7d2580410583c581f6310dfd0daa1be91514fd1cc94e60c57766"; reference:url,publicmosaic.com/indicators; sid:9102194; rev:2;)
alert tls $HOME_NET any -> 68.178.205.17 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"7b8c524de52d7d2580410583c581f6310dfd0daa1be91514fd1cc94e60c57766"; reference:url,publicmosaic.com/indicators; sid:9100738; rev:2;)
alert tls $HOME_NET any -> 77.73.129.82 443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"39c7e954ef36266f66ffdff1288fe4200ef7f31f53cb4d540184b117a0c74f4f"; reference:url,publicmosaic.com/indicators; sid:9100557; rev:2;)
alert tls $HOME_NET any -> 77.74.208.123 443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"690568b19cfee98e9a4f739f1ff447ab78c84b694cf394a802992c9d614f3899"; reference:url,publicmosaic.com/indicators; sid:9100556; rev:2;)
alert tls $HOME_NET any -> 78.39.51.23 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"6d66b1d79d936660c8e2e500e13404989fa6bfd5d0419f7ca0a2daada2eb7166"; reference:url,publicmosaic.com/indicators; sid:9105028; rev:2;)
alert tls $HOME_NET any -> 83.229.120.73 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"bf17b0f29a8ec5d60980bf25146e0615273406481f4ab81377a7b962ca082ca6"; reference:url,publicmosaic.com/indicators; sid:9100535; rev:2;)
alert tls $HOME_NET any -> 89.127.233.194 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"afa26d0c19d882152f6cae5ed3102a1e783a86bb6a10df4a64ba08e8cc56cd6e"; reference:url,publicmosaic.com/indicators; sid:9106058; rev:2;)
alert tls $HOME_NET any -> 89.144.53.144 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"ae468520d2be101e86da44535afdafeec1d5f5159c565c854a309c5a0638f1d9"; reference:url,publicmosaic.com/indicators; sid:9100128; rev:2;)
alert tls $HOME_NET any -> 89.147.111.64 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"14b79cba5815f953d39f570f098a8784922197fdf2a687d945641be55ea13c07"; reference:url,publicmosaic.com/indicators; sid:9101641; rev:2;)
alert tls $HOME_NET any -> 91.107.211.179 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"bbafe9bdf3f025a6b68c31ab5b191b4758da54d0e4657e8ca607bfcf3c97d645"; reference:url,publicmosaic.com/indicators; sid:9100763; rev:2;)
alert tls $HOME_NET any -> 92.63.180.96 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"60918c449a6b7414cdb742bbf2767720149fc9fd456a0316dbe5335ce8f62809"; reference:url,publicmosaic.com/indicators; sid:9100727; rev:2;)
alert tls $HOME_NET any -> 93.95.227.51 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"5675bbcd7dfe6599f5d68837f1fb3470cfc63e59b864b03eeee6bd73ded22839"; reference:url,publicmosaic.com/indicators; sid:9106063; rev:2;)
alert tls $HOME_NET any -> 102.117.165.202 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"aef46b2c00bfcc5b706ba17fb6bd968b0dc422d14278bc86aef1fdcec4f37aa3"; reference:url,publicmosaic.com/indicators; sid:9106825; rev:2;)
alert tls $HOME_NET any -> 102.117.166.237 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"aef46b2c00bfcc5b706ba17fb6bd968b0dc422d14278bc86aef1fdcec4f37aa3"; reference:url,publicmosaic.com/indicators; sid:9103873; rev:2;)
alert tls $HOME_NET any -> 102.117.169.96 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"aef46b2c00bfcc5b706ba17fb6bd968b0dc422d14278bc86aef1fdcec4f37aa3"; reference:url,publicmosaic.com/indicators; sid:9105029; rev:2;)
alert tls $HOME_NET any -> 103.41.177.64 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"27e7affcd7a1e5f224758fba50f2abdc1051be3b5a49a675017fbc582954a8d0"; reference:url,publicmosaic.com/indicators; sid:9100191; rev:2;)
alert tls $HOME_NET any -> 103.41.177.238 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"27e7affcd7a1e5f224758fba50f2abdc1051be3b5a49a675017fbc582954a8d0"; reference:url,publicmosaic.com/indicators; sid:9100192; rev:2;)
alert tls $HOME_NET any -> 103.153.254.32 6933 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"230a3d41ee0080303e61c0064ec844d0c57de2dd267c1e99d341dce3b928e2a8"; reference:url,publicmosaic.com/indicators; sid:9103775; rev:2;)
alert tls $HOME_NET any -> 103.185.249.13 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"c03152b51899d568c8c90cffb8a31c46e8a5f710e85a4eae9c51647dcd47a045"; reference:url,publicmosaic.com/indicators; sid:9100534; rev:2;)
alert tls $HOME_NET any -> 103.213.248.61 443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"0f385de0bad6d829bc754030280a52a6302c0a3f0fb015f3047f40aa542616d5"; reference:url,publicmosaic.com/indicators; sid:9100555; rev:2;)
alert tls $HOME_NET any -> 103.213.248.61 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"c5a4a32c575b67fb63064f91b27226cfb704b33f02e588cc2c563fde49326eff"; reference:url,publicmosaic.com/indicators; sid:9100533; rev:2;)
alert tls $HOME_NET any -> 103.214.112.9 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"62aa5156d0ebdf00102eedbc71461e3254ea37542a60125df8151d7186dc3f75"; reference:url,publicmosaic.com/indicators; sid:9104193; rev:2;)
alert tls $HOME_NET any -> 104.207.93.167 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"746f4e5d4a81149f0e6ec17502e20b0252655efc888b4da12a8f68ea7bfeda20"; reference:url,publicmosaic.com/indicators; sid:9100190; rev:2;)
alert tls $HOME_NET any -> 104.238.57.209 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"a443b5e1b54f4aa2b9e51a8f1c98d08d560a32a93fc119dff4d3681ee6a2ef53"; reference:url,publicmosaic.com/indicators; sid:9100810; rev:2;)
alert tls $HOME_NET any -> 104.248.69.160 65000 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"b599a50031b4d09a43536eb75060e97b939250674c5a45965996c709860110d8"; reference:url,publicmosaic.com/indicators; sid:9100549; rev:2;)
alert tls $HOME_NET any -> 107.172.3.15 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"fc9d809067512ced9d53e2778398ed8882fa03b1da41752cd1cdba78cd631a25"; reference:url,publicmosaic.com/indicators; sid:9100532; rev:2;)
alert tls $HOME_NET any -> 109.205.181.248 443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"a5ec865c3282466b012779c467452942b57d8dd27d842be07b7ede4404c51c79"; reference:url,publicmosaic.com/indicators; sid:9100554; rev:2;)
alert tls $HOME_NET any -> 109.205.181.248 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"58e2d5fff95ec226861cefe82989b0c070943688bd027674e6411bc1a4f68387"; reference:url,publicmosaic.com/indicators; sid:9100531; rev:2;)
alert tls $HOME_NET any -> 111.228.13.59 18443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"336b2236df745863a58f1412eab2c19547c38385dabc59d02872bae21409936c"; reference:url,publicmosaic.com/indicators; sid:9103338; rev:2;)
alert tls $HOME_NET any -> 113.31.118.180 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"50c7cfec14dfa2a477e4b7504fde35bd5ff8b969c0d94a8bbdadb25be7392265"; reference:url,publicmosaic.com/indicators; sid:9106057; rev:2;)
alert tls $HOME_NET any -> 132.145.21.240 443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"baef6458bb667f644310783af0ad188eafde2a46f7c37617f8123acfca83775d"; reference:url,publicmosaic.com/indicators; sid:9106061; rev:2;)
alert tcp $HOME_NET any -> 132.145.21.240 30000 (msg:"HOLLOWPOINT C2 mythic"; reference:url,publicmosaic.com/indicators; sid:9106060; rev:2;)
alert tls $HOME_NET any -> 134.209.41.160 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"4faf512e1a2838463c6d774659699bd4de28ad191c6ad81526e839f121a42809"; reference:url,publicmosaic.com/indicators; sid:9100528; rev:2;)
alert tls $HOME_NET any -> 134.209.112.52 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"666b3b08111c37913a424cad3cc240f90785b4aebd67abf8b9d3195d255008ff"; reference:url,publicmosaic.com/indicators; sid:9100790; rev:2;)
alert tls $HOME_NET any -> 134.209.146.147 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"822eb116bcb85addfd4e9e0d9dbd38d6d828543c5b7d0307190250f8c9979b1f"; reference:url,publicmosaic.com/indicators; sid:9100530; rev:2;)
alert tls $HOME_NET any -> 136.24.173.249 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"a77a031182c0a96f70955cb6bea6a167ae5386ef9cfdcc3b2fb0942cb32507c7"; reference:url,publicmosaic.com/indicators; sid:9100529; rev:2;)
alert tls $HOME_NET any -> 137.184.163.27 443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"2828aa780721634676bc349c1995304111653ff2fa60fb222733765da73fd957"; reference:url,publicmosaic.com/indicators; sid:9100547; rev:2;)
alert tls $HOME_NET any -> 137.184.163.27 5613 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"73097465003234dbb7f0857f20a79f45dac4dfebb6b6e3fa92af8c1467460b8a"; reference:url,publicmosaic.com/indicators; sid:9103337; rev:2;)
alert tls $HOME_NET any -> 139.99.144.141 443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"2601179921049a7160d1d4dda0784ff9a59e45a1c772d4e4b318ab1778fc7923"; reference:url,publicmosaic.com/indicators; sid:9106062; rev:2;)
alert tls $HOME_NET any -> 141.11.109.12 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"c79faf161f797591fd775f13a65853a175f708213f5ff2540499631aba178b66"; reference:url,publicmosaic.com/indicators; sid:9100789; rev:2;)
alert tls $HOME_NET any -> 142.93.52.11 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"0c90154fd7a7e9bdad0c698d9092e503c978ec71c7b702e7b0e0e24fb192a907"; reference:url,publicmosaic.com/indicators; sid:9100527; rev:2;)
alert tls $HOME_NET any -> 151.243.101.44 21343 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"c6920c097c678c1ce9d92020bbd99825b70a62f472073f9001cd4ff816f3f540"; reference:url,publicmosaic.com/indicators; sid:9103336; rev:2;)
alert tls $HOME_NET any -> 154.38.116.247 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"4e55ec2d85c561f6979f0f7d8a4d1c72a417d34f9d5a7b990ec026dad0404a62"; reference:url,publicmosaic.com/indicators; sid:9103335; rev:2;)
alert tls $HOME_NET any -> 154.198.49.31 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"ea90b53532c6fdbdfe121202ea3ecfe73592e69a4391b1d853fa578b83fb77cd"; reference:url,publicmosaic.com/indicators; sid:9100176; rev:2;)
alert tls $HOME_NET any -> 158.62.198.77 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"1689f5e69cbfc6eb0e8fc23817772aa24908bf1447e0038f618873eb38a430c2"; reference:url,publicmosaic.com/indicators; sid:9101740; rev:2;)
alert tls $HOME_NET any -> 158.158.0.196 443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"8050179d4ed123720223e5052a5fa23c1ab6b1939f54ffcde7267b03f8f77a1f"; reference:url,publicmosaic.com/indicators; sid:9100551; rev:2;)
alert tls $HOME_NET any -> 158.158.0.196 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"8567839e0bb75683b1e657021ec35bfb4f824b13b96aee2adaee58906c1b3be0"; reference:url,publicmosaic.com/indicators; sid:9100526; rev:2;)
alert tls $HOME_NET any -> 158.158.18.61 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"d02d2868493018128dde613e428a2e11274f9d09e40645b4ab523aa2892b7c9d"; reference:url,publicmosaic.com/indicators; sid:9103827; rev:2;)
alert tls $HOME_NET any -> 159.194.232.217 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"0d33010aff7c9116dfaefef20b7ef0449ea6b02d879ed42fb41295220d009541"; reference:url,publicmosaic.com/indicators; sid:9105992; rev:2;)
alert tls $HOME_NET any -> 159.195.242.22 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"cb930914ae3f58fc2f0f3fabb97a3e5f77111e57b57e7841f10c4464d63033b0"; reference:url,publicmosaic.com/indicators; sid:9100100; rev:2;)
alert tls $HOME_NET any -> 159.198.75.180 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"7c61f0c9014ab027a27ae0e266df278c2e1ddf378254e6371b8fde305a2a1c20"; reference:url,publicmosaic.com/indicators; sid:9101212; rev:2;)
alert tls $HOME_NET any -> 164.90.158.199 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"fe4a0ff21e4975e98d007069fcc729688af66d0a2c3a7cafd480731c45a07bcd"; reference:url,publicmosaic.com/indicators; sid:9100525; rev:2;)
alert tls $HOME_NET any -> 165.22.129.73 65000 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"35a069e5da46b9bd5a0e1c08157716af99680be7e32bbcbc6939d520c083b57d"; reference:url,publicmosaic.com/indicators; sid:9100544; rev:2;)
alert tls $HOME_NET any -> 169.58.150.161 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"5c75a36faedf425569a14b2e141c6f7e5e48f466b3ca05b35012c6a8ebc4b337"; reference:url,publicmosaic.com/indicators; sid:9104107; rev:2;)
alert tls $HOME_NET any -> 170.64.183.242 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"b48aa4806fa60c888d1c3115216862b89ff0f9aba2f01b9b324f8409d3444463"; reference:url,publicmosaic.com/indicators; sid:9106123; rev:2;)
alert tls $HOME_NET any -> 172.86.80.201 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"79ac03d4166023fc5e6ac436f005e693a693fb93cc7fd3b26467d18756162496"; reference:url,publicmosaic.com/indicators; sid:9103994; rev:2;)
alert tls $HOME_NET any -> 172.105.42.32 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"f67f23d0cad7ff824b8a7504ab44bebcade2d4d7a15726d0bd50594710d3a302"; reference:url,publicmosaic.com/indicators; sid:9106388; rev:2;)
alert tls $HOME_NET any -> 172.174.234.34 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"71768066e848b69f6a362f2f43811aa7199dc1e8042aeb9661f2e25acb9b607c"; reference:url,publicmosaic.com/indicators; sid:9100524; rev:2;)
alert tls $HOME_NET any -> 172.233.97.159 443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"e1411f04bf31f21d0ade4983c8e55767cd6c164fdbdf932473d9bdb170defd9b"; reference:url,publicmosaic.com/indicators; sid:9100553; rev:2;)
alert tls $HOME_NET any -> 174.138.9.149 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"4d6c37c29cd7e8496cf8c034aae7779bdc0135b2856d320ef0b367fd03afe6f4"; reference:url,publicmosaic.com/indicators; sid:9100523; rev:2;)
alert tls $HOME_NET any -> 174.138.86.141 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"f7538fa230cd3bba6da1ca7e71006845b251cea465957c5edfcff752e79f3c83"; reference:url,publicmosaic.com/indicators; sid:9100522; rev:2;)
alert tls $HOME_NET any -> 175.43.223.195 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"9194dbd48fd45a1a606477c5d14d703148d5f1e1346aa0dd7ae661dc5a66db0b"; reference:url,publicmosaic.com/indicators; sid:9100168; rev:2;)
alert tls $HOME_NET any -> 175.43.223.199 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"9194dbd48fd45a1a606477c5d14d703148d5f1e1346aa0dd7ae661dc5a66db0b"; reference:url,publicmosaic.com/indicators; sid:9101522; rev:2;)
alert tls $HOME_NET any -> 175.43.223.201 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"9194dbd48fd45a1a606477c5d14d703148d5f1e1346aa0dd7ae661dc5a66db0b"; reference:url,publicmosaic.com/indicators; sid:9106122; rev:2;)
alert tls $HOME_NET any -> 176.65.144.177 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"c568835dee22f34b47364a12a0b09a40f444b81b269517a0d639d44cd787b52c"; reference:url,publicmosaic.com/indicators; sid:9100167; rev:2;)
alert tls $HOME_NET any -> 185.227.152.231 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"3cc5047d9f2e014b2c3bd3795867ce0bc28044ba446e87b9fd9b91aed3aa07ca"; reference:url,publicmosaic.com/indicators; sid:9105030; rev:2;)
alert tls $HOME_NET any -> 187.145.56.252 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"749664258fb7dd13c589b52654136547e5e277aceb07d19b5fc4b1e95145e879"; reference:url,publicmosaic.com/indicators; sid:9100084; rev:2;)
alert tls $HOME_NET any -> 187.145.61.38 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"749664258fb7dd13c589b52654136547e5e277aceb07d19b5fc4b1e95145e879"; reference:url,publicmosaic.com/indicators; sid:9106821; rev:2;)
alert tls $HOME_NET any -> 187.145.123.29 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"749664258fb7dd13c589b52654136547e5e277aceb07d19b5fc4b1e95145e879"; reference:url,publicmosaic.com/indicators; sid:9104444; rev:2;)
alert tls $HOME_NET any -> 187.145.125.245 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"749664258fb7dd13c589b52654136547e5e277aceb07d19b5fc4b1e95145e879"; reference:url,publicmosaic.com/indicators; sid:9106387; rev:2;)
alert tls $HOME_NET any -> 188.166.40.236 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"2bb88c3b2b0006268acff8d3cb333dc773505aba63bb610ed61acbf3c2a52011"; reference:url,publicmosaic.com/indicators; sid:9100521; rev:2;)
alert tls $HOME_NET any -> 189.141.23.165 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"749664258fb7dd13c589b52654136547e5e277aceb07d19b5fc4b1e95145e879"; reference:url,publicmosaic.com/indicators; sid:9103872; rev:2;)
alert tls $HOME_NET any -> 189.249.193.210 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"749664258fb7dd13c589b52654136547e5e277aceb07d19b5fc4b1e95145e879"; reference:url,publicmosaic.com/indicators; sid:9100788; rev:2;)
alert tls $HOME_NET any -> 192.169.176.54 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"7b8c524de52d7d2580410583c581f6310dfd0daa1be91514fd1cc94e60c57766"; reference:url,publicmosaic.com/indicators; sid:9100744; rev:2;)
alert tls $HOME_NET any -> 193.29.13.44 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"6902538a835208f91d584d8845337728bc5d01b748fb5a36c91642db01f62275"; reference:url,publicmosaic.com/indicators; sid:9100520; rev:2;)
alert tls $HOME_NET any -> 194.26.192.117 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"7091540414755dbbf3239a3f771852a5e3f066251265dac328e0a020d0971be6"; reference:url,publicmosaic.com/indicators; sid:9100519; rev:2;)
alert tls $HOME_NET any -> 194.32.149.129 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"1c08e36ec1515ac3189dbdad81484843e0f6fdda9201a4b5394267109f691ac7"; reference:url,publicmosaic.com/indicators; sid:9105031; rev:2;)
alert tls $HOME_NET any -> 195.100.198.220 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"a9e416fac3a944a8e5dcdf8b466037204bc9be9877f6f43d420a483dd98fb64c"; reference:url,publicmosaic.com/indicators; sid:9100518; rev:2;)
alert tls $HOME_NET any -> 198.23.237.142 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"5a7551fbeb4a8125d1d8fa43799419b3bfa97e216106aba81544c69cf9134fee"; reference:url,publicmosaic.com/indicators; sid:9104106; rev:2;)
alert tls $HOME_NET any -> 198.199.86.166 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"ec0c6c21d73dbe28898f12835db504fcfdf83a04f5a3adc38ed7f260750d2222"; reference:url,publicmosaic.com/indicators; sid:9103333; rev:2;)
alert tls $HOME_NET any -> 203.83.238.164 8766 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"028be334f7d6668ccd8994a8161f9fff2e3da5d7ef4378c94d5e6d662c519347"; reference:url,publicmosaic.com/indicators; sid:9106826; rev:2;)
alert tls $HOME_NET any -> 203.83.238.164 9003 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"028be334f7d6668ccd8994a8161f9fff2e3da5d7ef4378c94d5e6d662c519347"; reference:url,publicmosaic.com/indicators; sid:9100552; rev:2;)
alert tls $HOME_NET any -> 203.83.238.164 9443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"028be334f7d6668ccd8994a8161f9fff2e3da5d7ef4378c94d5e6d662c519347"; reference:url,publicmosaic.com/indicators; sid:9100546; rev:2;)
alert tls $HOME_NET any -> 208.87.129.112 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"48700aa38e7cb4fde2706a9de7c8c7617a930bf9e36c8707ee7bdfc7634345f8"; reference:url,publicmosaic.com/indicators; sid:9103332; rev:2;)
alert tls $HOME_NET any -> 213.35.118.205 4322 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"91fbbac758ed2725df4bc340654aec2b881bdd4c2d95f8e6651cb0a68b69ca33"; reference:url,publicmosaic.com/indicators; sid:9100065; rev:2;)
alert tls $HOME_NET any -> 220.154.3.197 9443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"06b22b08b071b67b81574190c79463b637571fd197f0f1ab67ca56f7460f81c7"; reference:url,publicmosaic.com/indicators; sid:9100548; rev:2;)
alert tls $HOME_NET any -> 220.154.128.196 9443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"65e5046fec12df1137c99104cbbe62dac0cd0fd20e908fdc9a2fd4bdc315ebfc"; reference:url,publicmosaic.com/indicators; sid:9101151; rev:2;)
alert tls $HOME_NET any -> 221.132.29.137 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"ab7c52d27a54cd81832231bd05381309f7838a4b7480140ee8deb9bdaa4385e7"; reference:url,publicmosaic.com/indicators; sid:9100517; rev:2;)