# NOTE: 17 of 21 rule(s) below carry no published certificate and alert on
# address and port (alert tcp); the rest match the certificate fingerprint in the TLS handshake (alert tls).
# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 21 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: host 102.220.160.198
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
alert tcp $HOME_NET any -> 102.220.160.198 2500 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9105550; rev:2;)
alert tcp $HOME_NET any -> 102.220.160.198 2026 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9105551; rev:2;)
alert tcp $HOME_NET any -> 102.220.160.198 56002 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9104695; rev:2;)
alert tcp $HOME_NET any -> 102.220.160.198 2600 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9104241; rev:2;)
alert tcp $HOME_NET any -> 102.220.160.198 56003 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102110; rev:2;)
alert tcp $HOME_NET any -> 102.220.160.198 56001 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102111; rev:2;)
alert tcp $HOME_NET any -> 102.220.160.198 7707 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102112; rev:2;)
alert tcp $HOME_NET any -> 102.220.160.198 6666 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102113; rev:2;)
alert tcp $HOME_NET any -> 102.220.160.198 6606 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102114; rev:2;)
alert tcp $HOME_NET any -> 102.220.160.198 5555 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102115; rev:2;)
alert tcp $HOME_NET any -> 102.220.160.198 3500 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102116; rev:2;)
alert tcp $HOME_NET any -> 102.220.160.198 2025 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102117; rev:2;)
alert tcp $HOME_NET any -> 102.220.160.198 1506 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102118; rev:2;)
alert tcp $HOME_NET any -> 102.220.160.198 1505 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102119; rev:2;)
alert tls $HOME_NET any -> 102.220.160.198 8808 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"65a8ef64e5d7757cf017fd80952c1fdd65c96fd3ca295a460ca98c6d2a3c39a5"; reference:url,publicmosaic.com/indicators; sid:9101734; rev:2;)
alert tls $HOME_NET any -> 102.220.160.198 2027 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"65a8ef64e5d7757cf017fd80952c1fdd65c96fd3ca295a460ca98c6d2a3c39a5"; reference:url,publicmosaic.com/indicators; sid:9101735; rev:2;)
alert tls $HOME_NET any -> 102.220.160.198 8888 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"65a8ef64e5d7757cf017fd80952c1fdd65c96fd3ca295a460ca98c6d2a3c39a5"; reference:url,publicmosaic.com/indicators; sid:9101715; rev:2;)
alert tcp $HOME_NET any -> 102.220.160.198 5444 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9101630; rev:2;)
alert tcp $HOME_NET any -> 102.220.160.198 5333 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9101631; rev:2;)
alert tls $HOME_NET any -> 102.220.160.198 5222 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"65a8ef64e5d7757cf017fd80952c1fdd65c96fd3ca295a460ca98c6d2a3c39a5"; reference:url,publicmosaic.com/indicators; sid:9101585; rev:2;)
alert tcp $HOME_NET any -> 102.220.160.198 7001 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9101570; rev:2;)