# publicmosaic.rules — generated 2026-10-30 19:07 UTC — 4 rules — TLP:CLEAR
# source: https://publicmosaic.com — published for defensive use
# scope: cert e8e5a4f101a556a34c1751be0e08db8b70c6bb33e07f86c92df23791b916e2c4 — https://publicmosaic.com/cert/e8e5a4f101a556a34c1751be0e08db8b70c6bb33e07f86c92df23791b916e2c4
# rev:4 — replace every earlier rule file from this site. Suricata refuses a duplicate sid, so never load an older one beside this one.
# covers listed listeners only; archived listings omitted: 0
# A withdrawal can take up to five minutes to reach this file. Each address's page under publicmosaic.com/ip/ is authoritative.
alert tcp $HOME_NET any -> 15.235.148.248 443 (msg:"Public Mosaic C2 PureRAT"; reference:url,publicmosaic.com/ip/15.235.148.248; sid:9110069; rev:4;)
alert tcp $HOME_NET any -> 70.36.127.16 443 (msg:"Public Mosaic C2 PureRAT"; reference:url,publicmosaic.com/ip/70.36.127.16; sid:9110422; rev:4;)
alert tcp $HOME_NET any -> 70.36.127.51 443 (msg:"Public Mosaic C2 PureRAT"; reference:url,publicmosaic.com/ip/70.36.127.51; sid:9111207; rev:4;)
alert tcp $HOME_NET any -> 150.241.226.20 443 (msg:"Public Mosaic C2 PureRAT"; reference:url,publicmosaic.com/ip/150.241.226.20; sid:9109469; rev:4;)