# NOTE: 14 of 22 rule(s) below carry no published certificate and alert on
# address and port (alert tcp); the rest match the certificate fingerprint in the TLS handshake (alert tls).
# hollowpoint.rules — generated 2026-09-15 10:08 UTC — 22 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: host 38.247.165.127
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
alert tcp $HOME_NET any -> 38.247.165.127 5551 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9104992; rev:2;)
alert tcp $HOME_NET any -> 38.247.165.127 4655 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9104993; rev:2;)
alert tcp $HOME_NET any -> 38.247.165.127 9919 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102154; rev:2;)
alert tcp $HOME_NET any -> 38.247.165.127 8907 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102155; rev:2;)
alert tcp $HOME_NET any -> 38.247.165.127 8881 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102156; rev:2;)
alert tcp $HOME_NET any -> 38.247.165.127 8282 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102157; rev:2;)
alert tcp $HOME_NET any -> 38.247.165.127 8091 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102158; rev:2;)
alert tcp $HOME_NET any -> 38.247.165.127 8090 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102159; rev:2;)
alert tcp $HOME_NET any -> 38.247.165.127 8011 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102160; rev:2;)
alert tcp $HOME_NET any -> 38.247.165.127 7575 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102161; rev:2;)
alert tcp $HOME_NET any -> 38.247.165.127 5505 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102162; rev:2;)
alert tcp $HOME_NET any -> 38.247.165.127 4465 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102163; rev:2;)
alert tcp $HOME_NET any -> 38.247.165.127 4445 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102164; rev:2;)
alert tcp $HOME_NET any -> 38.247.165.127 3200 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102165; rev:2;)
alert tls $HOME_NET any -> 38.247.165.127 9000 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"0fce84827d8c922590395a80484d9841f7f2071a6c807573adcfdb168a43c430"; reference:url,publicmosaic.com/indicators; sid:9100839; rev:2;)
alert tls $HOME_NET any -> 38.247.165.127 8880 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"0fce84827d8c922590395a80484d9841f7f2071a6c807573adcfdb168a43c430"; reference:url,publicmosaic.com/indicators; sid:9100840; rev:2;)
alert tls $HOME_NET any -> 38.247.165.127 9909 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"0fce84827d8c922590395a80484d9841f7f2071a6c807573adcfdb168a43c430"; reference:url,publicmosaic.com/indicators; sid:9100841; rev:2;)
alert tls $HOME_NET any -> 38.247.165.127 8087 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"0fce84827d8c922590395a80484d9841f7f2071a6c807573adcfdb168a43c430"; reference:url,publicmosaic.com/indicators; sid:9100842; rev:2;)
alert tls $HOME_NET any -> 38.247.165.127 9090 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"0fce84827d8c922590395a80484d9841f7f2071a6c807573adcfdb168a43c430"; reference:url,publicmosaic.com/indicators; sid:9100843; rev:2;)
alert tls $HOME_NET any -> 38.247.165.127 8080 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"0fce84827d8c922590395a80484d9841f7f2071a6c807573adcfdb168a43c430"; reference:url,publicmosaic.com/indicators; sid:9100844; rev:2;)
alert tls $HOME_NET any -> 38.247.165.127 8000 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"0fce84827d8c922590395a80484d9841f7f2071a6c807573adcfdb168a43c430"; reference:url,publicmosaic.com/indicators; sid:9100845; rev:2;)
alert tls $HOME_NET any -> 38.247.165.127 7707 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"0fce84827d8c922590395a80484d9841f7f2071a6c807573adcfdb168a43c430"; reference:url,publicmosaic.com/indicators; sid:9100846; rev:2;)