# hollowpoint.rules — generated 2026-09-15 10:08 UTC — 2 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: host 43.108.51.124
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
alert tls $HOME_NET any -> 43.108.51.124 10001 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"d450a4057ac6e8bf23eb61933ef1edd5ed073395e6e17adb12ef0918193cc645"; reference:url,publicmosaic.com/indicators; sid:9105198; rev:2;)
alert tls $HOME_NET any -> 43.108.51.124 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"a0893daff71993c0dbd95e0294d50f758174e313689b4ce233a3d49368f76891"; reference:url,publicmosaic.com/indicators; sid:9100026; rev:2;)