# NOTE: 1 of 3 rule(s) below carry no published certificate and alert on
# address and port (alert tcp); the rest match the certificate fingerprint in the TLS handshake (alert tls).
# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 3 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: host 46.151.182.182
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
alert tls $HOME_NET any -> 46.151.182.182 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"4e98f61b5d6a53e6870486f24d70f260bd8728381932cc1ba42d95bbf141c6c8"; reference:url,publicmosaic.com/indicators; sid:9104696; rev:2;)
alert tcp $HOME_NET any -> 46.151.182.182 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9103958; rev:2;)
alert tls $HOME_NET any -> 46.151.182.182 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"7fda6f6135fbf79b8e2ce2328bf381a5ec06ad4ee39a499159e0773f9c9a7631"; reference:url,publicmosaic.com/indicators; sid:9100391; rev:2;)