# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 2 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: host 20.2.140.201
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
alert tls $HOME_NET any -> 20.2.140.201 40056 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"96ec4421ae52bc0763d58b769aee1941870407f0e62fc57254dcf5cf181e3c1c"; reference:url,publicmosaic.com/indicators; sid:9104180; rev:2;)
alert tls $HOME_NET any -> 20.2.140.201 8443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"e52ce0cb37e4e5eb28ffb7be345fb72158701d801f0907f1104659eacf73b75d"; reference:url,publicmosaic.com/indicators; sid:9103896; rev:2;)