# publicmosaic.rules — generated 2026-10-30 18:37 UTC — 8 rules — TLP:CLEAR
# source: https://publicmosaic.com — published for defensive use
# scope: cert d084b16db621b8c8ea84d824880bbae1a909b07ca96f487ef5a6dae5210b10a4 — https://publicmosaic.com/cert/d084b16db621b8c8ea84d824880bbae1a909b07ca96f487ef5a6dae5210b10a4
# rev:4 — replace every earlier rule file from this site. Suricata refuses a duplicate sid, so never load an older one beside this one.
# covers listed listeners only; archived listings omitted: 0
# A withdrawal can take up to five minutes to reach this file. Each address's page under publicmosaic.com/ip/ is authoritative.
alert tcp $HOME_NET any -> 95.158.131.135 7443 (msg:"Public Mosaic C2 Mythic"; reference:url,publicmosaic.com/ip/95.158.131.135; sid:9106939; rev:4;)
alert tcp $HOME_NET any -> 95.158.131.139 7443 (msg:"Public Mosaic C2 Mythic"; reference:url,publicmosaic.com/ip/95.158.131.139; sid:9106938; rev:4;)
alert tcp $HOME_NET any -> 95.158.131.141 7443 (msg:"Public Mosaic C2 Mythic"; reference:url,publicmosaic.com/ip/95.158.131.141; sid:9106937; rev:4;)
alert tcp $HOME_NET any -> 95.158.131.142 7443 (msg:"Public Mosaic C2 Mythic"; reference:url,publicmosaic.com/ip/95.158.131.142; sid:9106936; rev:4;)
alert tcp $HOME_NET any -> 95.158.131.144 7443 (msg:"Public Mosaic C2 Mythic"; reference:url,publicmosaic.com/ip/95.158.131.144; sid:9106935; rev:4;)
alert tcp $HOME_NET any -> 95.158.131.147 7443 (msg:"Public Mosaic C2 Mythic"; reference:url,publicmosaic.com/ip/95.158.131.147; sid:9106934; rev:4;)
alert tcp $HOME_NET any -> 95.158.131.149 7443 (msg:"Public Mosaic C2 Mythic"; reference:url,publicmosaic.com/ip/95.158.131.149; sid:9106933; rev:4;)
alert tcp $HOME_NET any -> 95.158.131.151 7443 (msg:"Public Mosaic C2 Mythic"; reference:url,publicmosaic.com/ip/95.158.131.151; sid:9106932; rev:4;)