# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 4 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: host 103.54.153.49
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
alert tls $HOME_NET any -> 103.54.153.49 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"63bfe77fd83ff334a9be0cfadb4912ab923d801a6ff0f0e54c63abd4e2bcd788"; reference:url,publicmosaic.com/indicators; sid:9101714; rev:2;)
alert tls $HOME_NET any -> 103.54.153.49 56003 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"c53128ba36cb23239c9c4e1c75c4af61aaddd22180ab1c20ee5bb1419caeed9a"; reference:url,publicmosaic.com/indicators; sid:9101665; rev:2;)
alert tls $HOME_NET any -> 103.54.153.49 56002 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"c53128ba36cb23239c9c4e1c75c4af61aaddd22180ab1c20ee5bb1419caeed9a"; reference:url,publicmosaic.com/indicators; sid:9101666; rev:2;)
alert tls $HOME_NET any -> 103.54.153.49 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"c53128ba36cb23239c9c4e1c75c4af61aaddd22180ab1c20ee5bb1419caeed9a"; reference:url,publicmosaic.com/indicators; sid:9101667; rev:2;)