# NOTE: 35 of 46 rule(s) below carry no published certificate and alert on
# address and port (alert tcp); the rest match the certificate fingerprint in the TLS handshake (alert tls).
# hollowpoint.rules — generated 2026-09-15 10:08 UTC — 46 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: host 80.190.77.86
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
alert tcp $HOME_NET any -> 80.190.77.86 30200 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9106200; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 10600 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9106201; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 30100 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9103829; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 20600 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9103830; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 6606 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9103831; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 700 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9103832; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 30900 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102122; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 20500 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102123; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 20300 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102124; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 20100 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102125; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 10500 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102126; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 9009 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102127; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 8808 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102128; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 8008 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102129; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 5005 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102130; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 2025 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102131; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 2020 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102132; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 2005 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102133; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 2002 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102134; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 2001 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102135; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 1111 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102136; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 1010 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102137; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 1009 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102138; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 1008 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102139; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 1007 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102140; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 1006 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102141; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 1005 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102142; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 1004 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102143; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 1003 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102144; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 1002 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102145; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 1000 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102146; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 1001 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9101745; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 20800 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9101642; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 2414 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9101336; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 10700 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9101197; rev:2;)
alert tls $HOME_NET any -> 80.190.77.86 9909 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe"; reference:url,publicmosaic.com/indicators; sid:9100137; rev:2;)
alert tls $HOME_NET any -> 80.190.77.86 2004 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe"; reference:url,publicmosaic.com/indicators; sid:9100129; rev:2;)
alert tls $HOME_NET any -> 80.190.77.86 20700 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe"; reference:url,publicmosaic.com/indicators; sid:9100136; rev:2;)
alert tls $HOME_NET any -> 80.190.77.86 2000 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe"; reference:url,publicmosaic.com/indicators; sid:9100138; rev:2;)
alert tls $HOME_NET any -> 80.190.77.86 2003 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe"; reference:url,publicmosaic.com/indicators; sid:9100139; rev:2;)
alert tls $HOME_NET any -> 80.190.77.86 2222 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe"; reference:url,publicmosaic.com/indicators; sid:9100130; rev:2;)
alert tls $HOME_NET any -> 80.190.77.86 30700 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe"; reference:url,publicmosaic.com/indicators; sid:9100134; rev:2;)
alert tls $HOME_NET any -> 80.190.77.86 6006 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe"; reference:url,publicmosaic.com/indicators; sid:9100135; rev:2;)
alert tls $HOME_NET any -> 80.190.77.86 7007 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe"; reference:url,publicmosaic.com/indicators; sid:9100132; rev:2;)
alert tls $HOME_NET any -> 80.190.77.86 222 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe"; reference:url,publicmosaic.com/indicators; sid:9100140; rev:2;)
alert tls $HOME_NET any -> 80.190.77.86 7707 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe"; reference:url,publicmosaic.com/indicators; sid:9100765; rev:2;)