# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 29 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: family pyramid-c2 — https://publicmosaic.com/c2/pyramid-c2
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 0
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tcp $HOME_NET any -> 37.77.150.174 4332 (msg:"HOLLOWPOINT C2 pyramid_c2"; reference:url,publicmosaic.com/indicators; sid:9104494; rev:2;)
alert tcp $HOME_NET any -> 37.77.150.174 4333 (msg:"HOLLOWPOINT C2 pyramid_c2"; reference:url,publicmosaic.com/indicators; sid:9102219; rev:2;)
alert tcp $HOME_NET any -> 38.146.28.93 8000 (msg:"HOLLOWPOINT C2 pyramid_c2"; reference:url,publicmosaic.com/indicators; sid:9103799; rev:2;)
alert tcp $HOME_NET any -> 54.38.94.225 8880 (msg:"HOLLOWPOINT C2 pyramid_c2"; reference:url,publicmosaic.com/indicators; sid:9100267; rev:2;)
alert tcp $HOME_NET any -> 54.38.94.225 8881 (msg:"HOLLOWPOINT C2 pyramid_c2"; reference:url,publicmosaic.com/indicators; sid:9103798; rev:2;)
alert tcp $HOME_NET any -> 54.38.94.225 8882 (msg:"HOLLOWPOINT C2 pyramid_c2"; reference:url,publicmosaic.com/indicators; sid:9103797; rev:2;)
alert tcp $HOME_NET any -> 54.38.94.225 8883 (msg:"HOLLOWPOINT C2 pyramid_c2"; reference:url,publicmosaic.com/indicators; sid:9100265; rev:2;)
alert tcp $HOME_NET any -> 54.38.94.225 8884 (msg:"HOLLOWPOINT C2 pyramid_c2"; reference:url,publicmosaic.com/indicators; sid:9103796; rev:2;)
alert tcp $HOME_NET any -> 54.38.94.225 8885 (msg:"HOLLOWPOINT C2 pyramid_c2"; reference:url,publicmosaic.com/indicators; sid:9103795; rev:2;)
alert tcp $HOME_NET any -> 54.38.94.225 8886 (msg:"HOLLOWPOINT C2 pyramid_c2"; reference:url,publicmosaic.com/indicators; sid:9100264; rev:2;)
alert tcp $HOME_NET any -> 54.38.94.225 8887 (msg:"HOLLOWPOINT C2 pyramid_c2"; reference:url,publicmosaic.com/indicators; sid:9103794; rev:2;)
alert tcp $HOME_NET any -> 91.206.178.155 443 (msg:"HOLLOWPOINT C2 pyramid_c2"; reference:url,publicmosaic.com/indicators; sid:9100266; rev:2;)
alert tcp $HOME_NET any -> 108.181.182.143 8000 (msg:"HOLLOWPOINT C2 pyramid_c2"; reference:url,publicmosaic.com/indicators; sid:9103793; rev:2;)
alert tcp $HOME_NET any -> 158.255.213.22 63421 (msg:"HOLLOWPOINT C2 pyramid_c2"; reference:url,publicmosaic.com/indicators; sid:9103792; rev:2;)
alert tcp $HOME_NET any -> 162.252.173.12 8000 (msg:"HOLLOWPOINT C2 pyramid_c2"; reference:url,publicmosaic.com/indicators; sid:9103791; rev:2;)
alert tcp $HOME_NET any -> 167.99.139.231 8004 (msg:"HOLLOWPOINT C2 pyramid_c2"; reference:url,publicmosaic.com/indicators; sid:9100268; rev:2;)
alert tcp $HOME_NET any -> 185.33.86.15 8000 (msg:"HOLLOWPOINT C2 pyramid_c2"; reference:url,publicmosaic.com/indicators; sid:9103790; rev:2;)
alert tcp $HOME_NET any -> 185.174.101.69 8000 (msg:"HOLLOWPOINT C2 pyramid_c2"; reference:url,publicmosaic.com/indicators; sid:9103789; rev:2;)
alert tcp $HOME_NET any -> 185.174.101.240 8000 (msg:"HOLLOWPOINT C2 pyramid_c2"; reference:url,publicmosaic.com/indicators; sid:9103788; rev:2;)
alert tcp $HOME_NET any -> 185.233.166.124 9702 (msg:"HOLLOWPOINT C2 pyramid_c2"; reference:url,publicmosaic.com/indicators; sid:9103787; rev:2;)
alert tcp $HOME_NET any -> 188.23.175.25 8000 (msg:"HOLLOWPOINT C2 pyramid_c2"; reference:url,publicmosaic.com/indicators; sid:9100082; rev:2;)
alert tls $HOME_NET any -> 194.100.215.101 8100 (msg:"HOLLOWPOINT C2 pyramid_c2"; tls.cert_fingerprint; content:"09d3fc77af49fabebcfc0e882aec0e3820cb2c6f0e3a96f65a9ecc1c3df98276"; reference:url,publicmosaic.com/indicators; sid:9103786; rev:2;)
alert tcp $HOME_NET any -> 217.245.100.240 61380 (msg:"HOLLOWPOINT C2 pyramid_c2"; reference:url,publicmosaic.com/indicators; sid:9106801; rev:2;)
alert tcp $HOME_NET any -> 217.245.102.235 61380 (msg:"HOLLOWPOINT C2 pyramid_c2"; reference:url,publicmosaic.com/indicators; sid:9106625; rev:2;)
alert tcp $HOME_NET any -> 217.245.103.81 80 (msg:"HOLLOWPOINT C2 pyramid_c2"; reference:url,publicmosaic.com/indicators; sid:9104240; rev:2;)
alert tcp $HOME_NET any -> 217.245.109.150 61380 (msg:"HOLLOWPOINT C2 pyramid_c2"; reference:url,publicmosaic.com/indicators; sid:9103785; rev:2;)
alert tcp $HOME_NET any -> 217.245.113.252 61380 (msg:"HOLLOWPOINT C2 pyramid_c2"; reference:url,publicmosaic.com/indicators; sid:9106012; rev:2;)
alert tcp $HOME_NET any -> 217.245.119.29 80 (msg:"HOLLOWPOINT C2 pyramid_c2"; reference:url,publicmosaic.com/indicators; sid:9106624; rev:2;)
alert tcp $HOME_NET any -> 217.245.119.139 80 (msg:"HOLLOWPOINT C2 pyramid_c2"; reference:url,publicmosaic.com/indicators; sid:9103784; rev:2;)