# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 3 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: host 103.226.250.31
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
alert tls $HOME_NET any -> 103.226.250.31 9345 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"3785e797d9d80779648f2e64b23d62c89d48f6f80e3af7268c7e17fc20bffe63"; reference:url,publicmosaic.com/indicators; sid:9101081; rev:2;)
alert tls $HOME_NET any -> 103.226.250.31 6443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"d0056bbf531764f212163c1a7b13d58b84c30a2ae386b105d19e300d8f19c741"; reference:url,publicmosaic.com/indicators; sid:9101086; rev:2;)
alert tls $HOME_NET any -> 103.226.250.31 10250 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"4983d9c83981e5758f31d65cb5c5211098f3d24937a52d50a1750652857c7151"; reference:url,publicmosaic.com/indicators; sid:9101088; rev:2;)