# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 315 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: ja4x 2166164053c1_2166164053c1_30d204a01551 — https://publicmosaic.com/ja4x/2166164053c1_2166164053c1_30d204a01551
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 0
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tls $HOME_NET any -> 1.14.104.208 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"ef533656d343ef391fa3175e3d17a32a81afd387371d81bf74c9dc5277c1961d"; reference:url,publicmosaic.com/indicators; sid:9105197; rev:2;)
alert tls $HOME_NET any -> 1.15.76.39 8443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100012; rev:2;)
alert tls $HOME_NET any -> 1.15.76.39 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c376478"; reference:url,publicmosaic.com/indicators; sid:9100013; rev:2;)
alert tls $HOME_NET any -> 2.28.71.175 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9103410; rev:2;)
alert tls $HOME_NET any -> 4.253.8.171 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100221; rev:2;)
alert tls $HOME_NET any -> 8.134.70.73 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"0f25a03dd7dfdd4b18c96fd00409a700a5aff274a23c46d69af9eb9057f58733"; reference:url,publicmosaic.com/indicators; sid:9100024; rev:2;)
alert tls $HOME_NET any -> 8.134.166.14 54451 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100039; rev:2;)
alert tls $HOME_NET any -> 8.137.169.91 50000 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c376478"; reference:url,publicmosaic.com/indicators; sid:9100233; rev:2;)
alert tls $HOME_NET any -> 8.141.94.69 7890 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"f402d73a8cbf8e7ed61ad090aa4fb8146120d0774c0ebffbeb33c451c55e3fe7"; reference:url,publicmosaic.com/indicators; sid:9105173; rev:2;)
alert tls $HOME_NET any -> 8.145.60.152 4435 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9104120; rev:2;)
alert tls $HOME_NET any -> 8.145.61.81 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"c482304da1a4532c7b73ca2c298bc78f3a11ba1fdd6cb792e72c285dcb4035bf"; reference:url,publicmosaic.com/indicators; sid:9106328; rev:2;)
alert tls $HOME_NET any -> 8.146.207.128 8443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"8848f4cc93d21742dd71884c06aaa159bf143b186ab5e9ed1f822fdcd8f0d489"; reference:url,publicmosaic.com/indicators; sid:9103419; rev:2;)
alert tls $HOME_NET any -> 8.146.228.220 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9106478; rev:2;)
alert tls $HOME_NET any -> 8.148.201.210 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c376478"; reference:url,publicmosaic.com/indicators; sid:9103382; rev:2;)
alert tls $HOME_NET any -> 8.152.212.104 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"3ddcc14ae6a022660d95ef3632ef195f230fa6e1132ed6aac7c330c7a56a66d2"; reference:url,publicmosaic.com/indicators; sid:9100004; rev:2;)
alert tls $HOME_NET any -> 8.163.49.50 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"4d79c7171e66dbb68859a76c8e6f7fd8c41cd886247e7bb95671892b03cde5a1"; reference:url,publicmosaic.com/indicators; sid:9100023; rev:2;)
alert tls $HOME_NET any -> 8.163.59.20 8008 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9106622; rev:2;)
alert tls $HOME_NET any -> 8.163.98.217 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"9c2a9f3ab78445641850bf12b87bd0cd88ac39275c8316406cf788ee584a60c6"; reference:url,publicmosaic.com/indicators; sid:9100133; rev:2;)
alert tls $HOME_NET any -> 8.219.220.240 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100254; rev:2;)
alert tls $HOME_NET any -> 8.219.220.240 7443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100220; rev:2;)
alert tls $HOME_NET any -> 8.222.147.42 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"ec0d57d9410b5f7c6d0dc6f49fd99c6eebcab21e8fa1f087ee3f6e254a5e30c6"; reference:url,publicmosaic.com/indicators; sid:9105174; rev:2;)
alert tls $HOME_NET any -> 8.222.188.173 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100208; rev:2;)
alert tls $HOME_NET any -> 14.29.160.181 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"2c42be2a42c6c3edbf3ce7c7ef6b5a8f0c6227f3a11ec653147e82226c59ab35"; reference:url,publicmosaic.com/indicators; sid:9100245; rev:2;)
alert tls $HOME_NET any -> 14.225.212.124 30005 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100219; rev:2;)
alert tls $HOME_NET any -> 14.225.212.124 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"4d7a055b35f3834e2fec4625f3a0738a5e206f1e3bb818b4b823799daf551183"; reference:url,publicmosaic.com/indicators; sid:9100244; rev:2;)
alert tls $HOME_NET any -> 20.15.58.107 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100209; rev:2;)
alert tls $HOME_NET any -> 20.15.58.107 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"92d337a8b451d5d41d6809d11318f26d0da22ff81b4da8f97bffbfa04f5c494b"; reference:url,publicmosaic.com/indicators; sid:9100243; rev:2;)
alert tls $HOME_NET any -> 20.187.120.42 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c376478"; reference:url,publicmosaic.com/indicators; sid:9100237; rev:2;)
alert tls $HOME_NET any -> 23.95.170.223 18443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"5e8679fb05392323dbd9f7aab52c114f334425634eea9685ab5e0df34d7b9537"; reference:url,publicmosaic.com/indicators; sid:9100285; rev:2;)
alert tls $HOME_NET any -> 23.141.12.111 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"a1f307a646f3c854ef625101413e9b18506d4b4693685063cfe9e78075ab909f"; reference:url,publicmosaic.com/indicators; sid:9100419; rev:2;)
alert tls $HOME_NET any -> 24.199.90.142 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"4eb1323d5b67996a42f607d347e1dd58cb2f673ea3429496db60b944dabbd3b6"; reference:url,publicmosaic.com/indicators; sid:9101508; rev:2;)
alert tls $HOME_NET any -> 34.56.42.78 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100585; rev:2;)
alert tls $HOME_NET any -> 34.68.221.226 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100210; rev:2;)
alert tls $HOME_NET any -> 34.92.128.98 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"2797d96c72a0f4ec7856a69585297ac1579f60cf2ab780012a88c9339e1e1a26"; reference:url,publicmosaic.com/indicators; sid:9100422; rev:2;)
alert tls $HOME_NET any -> 35.212.136.13 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"42c6ba12623518c31b561c881a13a458bcabfcdc67ad638f0bc940f54bd8d884"; reference:url,publicmosaic.com/indicators; sid:9106657; rev:2;)
alert tls $HOME_NET any -> 36.133.104.91 8888 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"495081da58b2530b089cd1dc02269754f9940e98a295fac12117201e706012ab"; reference:url,publicmosaic.com/indicators; sid:9101649; rev:2;)
alert tls $HOME_NET any -> 36.140.162.173 7777 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100847; rev:2;)
alert tls $HOME_NET any -> 38.76.183.197 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9106621; rev:2;)
alert tls $HOME_NET any -> 38.147.185.54 10443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9106623; rev:2;)
alert tls $HOME_NET any -> 39.96.125.59 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"64257fc0fac31c01a5ccd816c73ea86e639260da1604d04db869bb603c2886e6"; reference:url,publicmosaic.com/indicators; sid:9106222; rev:2;)
alert tls $HOME_NET any -> 39.96.201.230 8443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"8848f4cc93d21742dd71884c06aaa159bf143b186ab5e9ed1f822fdcd8f0d489"; reference:url,publicmosaic.com/indicators; sid:9105643; rev:2;)
alert tls $HOME_NET any -> 39.97.57.155 1222 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c376478"; reference:url,publicmosaic.com/indicators; sid:9103466; rev:2;)
alert tls $HOME_NET any -> 39.97.57.155 1223 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c376478"; reference:url,publicmosaic.com/indicators; sid:9103465; rev:2;)
alert tls $HOME_NET any -> 39.97.57.155 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c376478"; reference:url,publicmosaic.com/indicators; sid:9104836; rev:2;)
alert tls $HOME_NET any -> 39.102.58.148 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"2d62582ac0164c4968a54a859c849cf574e3b065be0e95e3a7579f02b24eef61"; reference:url,publicmosaic.com/indicators; sid:9105156; rev:2;)
alert tls $HOME_NET any -> 39.105.200.188 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100800; rev:2;)
alert tls $HOME_NET any -> 39.106.205.6 6963 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"fe1eb6cdb7afddd1e6a74c1159a903c23859b2d58732f1534bed32905b92119e"; reference:url,publicmosaic.com/indicators; sid:9105172; rev:2;)
alert tls $HOME_NET any -> 42.193.123.90 16631 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9106280; rev:2;)
alert tls $HOME_NET any -> 42.193.227.214 3006 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"75a363daf68ef38db1b965d5ce00c112f577414cce93c307b23746697de9ce02"; reference:url,publicmosaic.com/indicators; sid:9103381; rev:2;)
alert tls $HOME_NET any -> 42.194.241.92 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c376478"; reference:url,publicmosaic.com/indicators; sid:9100792; rev:2;)
alert tls $HOME_NET any -> 43.108.51.124 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"a0893daff71993c0dbd95e0294d50f758174e313689b4ce233a3d49368f76891"; reference:url,publicmosaic.com/indicators; sid:9100026; rev:2;)
alert tls $HOME_NET any -> 43.108.51.124 10001 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"d450a4057ac6e8bf23eb61933ef1edd5ed073395e6e17adb12ef0918193cc645"; reference:url,publicmosaic.com/indicators; sid:9105198; rev:2;)
alert tls $HOME_NET any -> 43.136.19.18 30086 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c376478"; reference:url,publicmosaic.com/indicators; sid:9103408; rev:2;)
alert tls $HOME_NET any -> 43.138.104.38 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100206; rev:2;)
alert tls $HOME_NET any -> 43.138.116.60 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"b337f0a1aa3508de74d20becc5085d59d8c2e911982e19767dc3a09359d11582"; reference:url,publicmosaic.com/indicators; sid:9103461; rev:2;)
alert tls $HOME_NET any -> 43.138.116.60 8443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"49469b5e904374cdfe242b2d1c7d72fc696483b16973251b33f94290c474e70a"; reference:url,publicmosaic.com/indicators; sid:9103460; rev:2;)
alert tls $HOME_NET any -> 43.138.225.166 3323 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"86d13e06f082d9ec66499cb3453df171adac1db2ed3e27b3413bb2505a6afd70"; reference:url,publicmosaic.com/indicators; sid:9105182; rev:2;)
alert tls $HOME_NET any -> 43.139.108.161 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"7d9cadb480b05c944c3a4ba94a8a746d0ecba67c4b5697fcea15a52f3275445a"; reference:url,publicmosaic.com/indicators; sid:9100235; rev:2;)
alert tls $HOME_NET any -> 43.140.219.182 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100775; rev:2;)
alert tls $HOME_NET any -> 43.142.137.169 18443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9103421; rev:2;)
alert tls $HOME_NET any -> 43.155.9.112 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9103880; rev:2;)
alert tls $HOME_NET any -> 43.243.73.187 24871 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c376478"; reference:url,publicmosaic.com/indicators; sid:9103376; rev:2;)
alert tls $HOME_NET any -> 45.9.249.179 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100218; rev:2;)
alert tls $HOME_NET any -> 45.87.53.6 38778 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"ac7ed3a41b7874c3daa1bd18cfcdb8bce6f713193de595e16379ba0e282dfbe1"; reference:url,publicmosaic.com/indicators; sid:9105185; rev:2;)
alert tls $HOME_NET any -> 45.154.12.150 35201 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"319748f5a54688178d06eb21613109d9c67541e5bd9099a13192b2121cb1bb15"; reference:url,publicmosaic.com/indicators; sid:9103380; rev:2;)
alert tls $HOME_NET any -> 45.192.202.36 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"7b49fc589e7e738e3457859d269996ecef83f693570b0ac482c426b1fa04bd73"; reference:url,publicmosaic.com/indicators; sid:9103379; rev:2;)
alert tls $HOME_NET any -> 45.221.118.46 8080 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"ccce2223024b1326fc5b417f223a9fabc2bd5039a45b7f53e2ed5ae2186687fd"; reference:url,publicmosaic.com/indicators; sid:9100857; rev:2;)
alert tls $HOME_NET any -> 45.221.118.46 8443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"afc341b7408f295bf0ba93d4c700a9674894d92202cbec30192244542f54ce7d"; reference:url,publicmosaic.com/indicators; sid:9100856; rev:2;)
alert tls $HOME_NET any -> 46.151.182.190 4443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"a9d04845d472afc560615605a8f221e64c9e8ef90bb911fa38d614bab8b3335e"; reference:url,publicmosaic.com/indicators; sid:9104026; rev:2;)
alert tls $HOME_NET any -> 47.79.21.106 45678 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100043; rev:2;)
alert tls $HOME_NET any -> 47.82.234.12 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"400e11deddf4560e0cfd3d5a8d9c473a9ee55e92b3c6edb341ed039ac56c5cfa"; reference:url,publicmosaic.com/indicators; sid:9100255; rev:2;)
alert tls $HOME_NET any -> 47.82.234.12 8444 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"2c746495dde82a8d4b4e7c069cb3554e737997629035bfd3ad511010351ff903"; reference:url,publicmosaic.com/indicators; sid:9100248; rev:2;)
alert tls $HOME_NET any -> 47.82.234.12 8848 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"cbc15259f848d3089de52ec88c94b09180887a66a4d1dba8fb2e1d55581a6f4a"; reference:url,publicmosaic.com/indicators; sid:9100282; rev:2;)
alert tls $HOME_NET any -> 47.83.217.23 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"659f546f8f8549784a2579124c73091c49203c4679d931a673cb4b1b472c8357"; reference:url,publicmosaic.com/indicators; sid:9105196; rev:2;)
alert tls $HOME_NET any -> 47.84.50.235 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100211; rev:2;)
alert tls $HOME_NET any -> 47.84.141.91 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"ce95b02de3bd26782872ff4bd1d97be5a5e9d6cfa618144714746682ec016dc0"; reference:url,publicmosaic.com/indicators; sid:9105166; rev:2;)
alert tls $HOME_NET any -> 47.86.9.253 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"f9cdc3da3b6999dda4a5dfe1a0f5ca5697147c32a00dba81e576fd4901addbe1"; reference:url,publicmosaic.com/indicators; sid:9100242; rev:2;)
alert tls $HOME_NET any -> 47.86.184.71 10443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9103464; rev:2;)
alert tls $HOME_NET any -> 47.88.78.167 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"33dc87a7a114888d9e15fb4f664560efb15e51b86bb784d0a664a240c6a85e7c"; reference:url,publicmosaic.com/indicators; sid:9105160; rev:2;)
alert tls $HOME_NET any -> 47.90.209.157 54321 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c376478"; reference:url,publicmosaic.com/indicators; sid:9105823; rev:2;)
alert tls $HOME_NET any -> 47.92.208.27 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"c0829f1c1dd9e36ea9512f966f4663f14e6ea81ea0e436b2d8f43e9a1a6e845c"; reference:url,publicmosaic.com/indicators; sid:9100017; rev:2;)
alert tls $HOME_NET any -> 47.92.208.27 4466 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"789d370e692a27d3a27fcb6d788e075bea719c508b495ead51887425628cd86a"; reference:url,publicmosaic.com/indicators; sid:9103427; rev:2;)
alert tls $HOME_NET any -> 47.93.243.161 40218 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c376478"; reference:url,publicmosaic.com/indicators; sid:9103405; rev:2;)
alert tls $HOME_NET any -> 47.94.56.71 8443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"8848f4cc93d21742dd71884c06aaa159bf143b186ab5e9ed1f822fdcd8f0d489"; reference:url,publicmosaic.com/indicators; sid:9106079; rev:2;)
alert tls $HOME_NET any -> 47.94.224.229 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c376478"; reference:url,publicmosaic.com/indicators; sid:9100412; rev:2;)
alert tls $HOME_NET any -> 47.95.192.147 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c376478"; reference:url,publicmosaic.com/indicators; sid:9103451; rev:2;)
alert tls $HOME_NET any -> 47.95.201.24 9443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"8848f4cc93d21742dd71884c06aaa159bf143b186ab5e9ed1f822fdcd8f0d489"; reference:url,publicmosaic.com/indicators; sid:9103425; rev:2;)
alert tls $HOME_NET any -> 47.100.63.132 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"9b94eb2fe075d30738ae56857ae9daee6283ea891181f8fd641b9e7f2e80732f"; reference:url,publicmosaic.com/indicators; sid:9105204; rev:2;)
alert tls $HOME_NET any -> 47.101.51.235 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100769; rev:2;)
alert tls $HOME_NET any -> 47.103.213.138 6433 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100584; rev:2;)
alert tls $HOME_NET any -> 47.104.151.217 18443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"045ffa8fe1f54c2388fbd28dc90952dcfba3ed721e4e7592082823df4c390122"; reference:url,publicmosaic.com/indicators; sid:9104282; rev:2;)
alert tls $HOME_NET any -> 47.104.248.7 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"4116294a89c6cbff5c74c053ceafad8c750456e0f2a9eb3519b724dd91997fd4"; reference:url,publicmosaic.com/indicators; sid:9100415; rev:2;)
alert tls $HOME_NET any -> 47.105.36.109 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100421; rev:2;)
alert tls $HOME_NET any -> 47.108.25.113 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100418; rev:2;)
alert tls $HOME_NET any -> 47.109.130.74 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"0b9fe4bbaebe8e047a2b11c122b7007a9acd8514bc2856ae328333c01df877cb"; reference:url,publicmosaic.com/indicators; sid:9105176; rev:2;)
alert tls $HOME_NET any -> 47.109.198.8 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"463ae1eaf931717b27b6a82d67c03f8bceabe078b9e328395e453a76d120d283"; reference:url,publicmosaic.com/indicators; sid:9105195; rev:2;)
alert tls $HOME_NET any -> 47.113.98.42 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"a5e850cadbff10bc74313d848d7710801966b38bf4923ee37ad20c2495b3d6d0"; reference:url,publicmosaic.com/indicators; sid:9100014; rev:2;)
alert tls $HOME_NET any -> 47.113.190.244 50010 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"7615093d89ed09a1c628602a64a48f993325e6d9f18c23b444038588b5a8ccbe"; reference:url,publicmosaic.com/indicators; sid:9103449; rev:2;)
alert tls $HOME_NET any -> 47.113.206.140 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9103961; rev:2;)
alert tls $HOME_NET any -> 47.120.32.72 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c376478"; reference:url,publicmosaic.com/indicators; sid:9100232; rev:2;)
alert tls $HOME_NET any -> 47.236.56.15 4445 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9105338; rev:2;)
alert tls $HOME_NET any -> 47.236.56.15 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"12141108173fe7f1e1e1c53e2657357a975e639e45b65c005428ee06dccc3f3f"; reference:url,publicmosaic.com/indicators; sid:9105339; rev:2;)
alert tls $HOME_NET any -> 47.236.83.240 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"fa062fd8e48445f251b0694635fbf808f5c5094c83ffd69a795cfab7ddcaed55"; reference:url,publicmosaic.com/indicators; sid:9105171; rev:2;)
alert tls $HOME_NET any -> 47.251.29.219 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"33dc87a7a114888d9e15fb4f664560efb15e51b86bb784d0a664a240c6a85e7c"; reference:url,publicmosaic.com/indicators; sid:9105159; rev:2;)
alert tls $HOME_NET any -> 47.251.165.63 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"33dc87a7a114888d9e15fb4f664560efb15e51b86bb784d0a664a240c6a85e7c"; reference:url,publicmosaic.com/indicators; sid:9105150; rev:2;)
alert tls $HOME_NET any -> 47.251.177.187 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"33dc87a7a114888d9e15fb4f664560efb15e51b86bb784d0a664a240c6a85e7c"; reference:url,publicmosaic.com/indicators; sid:9105163; rev:2;)
alert tls $HOME_NET any -> 47.254.46.30 60891 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"68a889b3805cce6374e4a78b2a0bf78c2a6c51fb8cfbc7c720b8d15006844166"; reference:url,publicmosaic.com/indicators; sid:9103386; rev:2;)
alert tls $HOME_NET any -> 49.51.230.17 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"02fd77af71d8670199c4295286416c3aa3f06100430725c9e3feab0cec10dfe3"; reference:url,publicmosaic.com/indicators; sid:9105194; rev:2;)
alert tls $HOME_NET any -> 49.232.21.222 18443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9105018; rev:2;)
alert tls $HOME_NET any -> 49.233.202.218 18443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9103467; rev:2;)
alert tls $HOME_NET any -> 52.87.32.4 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9103403; rev:2;)
alert tls $HOME_NET any -> 52.87.32.4 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"2b1338db59e29d09d25f02426db4d0821411c7ed4e5003595e5e8aa1f3d2a97c"; reference:url,publicmosaic.com/indicators; sid:9103402; rev:2;)
alert tls $HOME_NET any -> 52.248.41.253 8443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100212; rev:2;)
alert tls $HOME_NET any -> 54.158.87.112 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100217; rev:2;)
alert tls $HOME_NET any -> 59.110.153.133 4444 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"d225e5e4d53b26f7de8062184dc82ef63663669ad50ee28a075294eafc9d7b6e"; reference:url,publicmosaic.com/indicators; sid:9106803; rev:2;)
alert tls $HOME_NET any -> 59.110.228.141 8443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"8848f4cc93d21742dd71884c06aaa159bf143b186ab5e9ed1f822fdcd8f0d489"; reference:url,publicmosaic.com/indicators; sid:9106078; rev:2;)
alert tls $HOME_NET any -> 60.217.23.146 7789 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9102945; rev:2;)
alert tls $HOME_NET any -> 60.247.206.23 7443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100003; rev:2;)
alert tls $HOME_NET any -> 60.247.206.23 50501 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c376478"; reference:url,publicmosaic.com/indicators; sid:9106772; rev:2;)
alert tls $HOME_NET any -> 62.72.42.58 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9101574; rev:2;)
alert tls $HOME_NET any -> 62.234.72.163 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100205; rev:2;)
alert tls $HOME_NET any -> 64.7.199.195 25568 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c376478"; reference:url,publicmosaic.com/indicators; sid:9103385; rev:2;)
alert tls $HOME_NET any -> 64.118.152.184 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"33dc87a7a114888d9e15fb4f664560efb15e51b86bb784d0a664a240c6a85e7c"; reference:url,publicmosaic.com/indicators; sid:9105155; rev:2;)
alert tls $HOME_NET any -> 64.118.152.195 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"33dc87a7a114888d9e15fb4f664560efb15e51b86bb784d0a664a240c6a85e7c"; reference:url,publicmosaic.com/indicators; sid:9106221; rev:2;)
alert tls $HOME_NET any -> 64.118.153.105 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"33dc87a7a114888d9e15fb4f664560efb15e51b86bb784d0a664a240c6a85e7c"; reference:url,publicmosaic.com/indicators; sid:9105153; rev:2;)
alert tls $HOME_NET any -> 64.118.153.106 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"33dc87a7a114888d9e15fb4f664560efb15e51b86bb784d0a664a240c6a85e7c"; reference:url,publicmosaic.com/indicators; sid:9105152; rev:2;)
alert tls $HOME_NET any -> 64.118.154.25 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"33dc87a7a114888d9e15fb4f664560efb15e51b86bb784d0a664a240c6a85e7c"; reference:url,publicmosaic.com/indicators; sid:9105151; rev:2;)
alert tls $HOME_NET any -> 65.49.233.218 2083 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9106626; rev:2;)
alert tls $HOME_NET any -> 68.64.182.169 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"1893dfe81a08bf41740a599f14ab1b108bbcf7c0895f051fe2c5af02f7174cb9"; reference:url,publicmosaic.com/indicators; sid:9105158; rev:2;)
alert tls $HOME_NET any -> 81.71.7.250 12347 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"2470dda5ded1dd96e9d2afcf6b94628bfb02f444cca0be1528d1f0d9e394dd87"; reference:url,publicmosaic.com/indicators; sid:9105533; rev:2;)
alert tls $HOME_NET any -> 82.156.80.106 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100035; rev:2;)
alert tls $HOME_NET any -> 82.156.219.31 8443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100005; rev:2;)
alert tls $HOME_NET any -> 82.157.183.28 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"904ddbde20ba0795aac669f01106a7b4c17cd13309dc196ae3932f531786838c"; reference:url,publicmosaic.com/indicators; sid:9100234; rev:2;)
alert tls $HOME_NET any -> 83.229.123.249 8443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"bdb5a0dce33a675b637a65bbba5a48c8a29d793d69f6c02c060740682f9de466"; reference:url,publicmosaic.com/indicators; sid:9106348; rev:2;)
alert tls $HOME_NET any -> 89.19.223.121 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"3395a825439fabb80a430b2275f3a5bc51d575e432640e1cd586095bdc4599f5"; reference:url,publicmosaic.com/indicators; sid:9105180; rev:2;)
alert tls $HOME_NET any -> 89.19.223.126 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"3395a825439fabb80a430b2275f3a5bc51d575e432640e1cd586095bdc4599f5"; reference:url,publicmosaic.com/indicators; sid:9105167; rev:2;)
alert tls $HOME_NET any -> 91.92.240.238 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100764; rev:2;)
alert tls $HOME_NET any -> 91.92.240.238 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"22c8467c27a4622f6665fbb430a466d585b13f3dd693fc5dbbc6d49d5ec816f7"; reference:url,publicmosaic.com/indicators; sid:9100734; rev:2;)
alert tls $HOME_NET any -> 95.182.114.29 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c376478"; reference:url,publicmosaic.com/indicators; sid:9100241; rev:2;)
alert tls $HOME_NET any -> 101.33.200.145 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100213; rev:2;)
alert tls $HOME_NET any -> 101.33.225.32 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"83581a5ba8722d33dc4ef082961d9575e3cc2ad4acdabc262e7a83b684a79449"; reference:url,publicmosaic.com/indicators; sid:9100001; rev:2;)
alert tls $HOME_NET any -> 101.35.238.122 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"31a4863751fc8f740499e035d2dfcb96c258a805ee78aeeb65f291bc5d5d0ef7"; reference:url,publicmosaic.com/indicators; sid:9105175; rev:2;)
alert tls $HOME_NET any -> 101.42.136.73 4488 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"985cd555ff28616638615bbbd5bc826d67d846a61b7b9274bc88b8f2dd4b3721"; reference:url,publicmosaic.com/indicators; sid:9103840; rev:2;)
alert tls $HOME_NET any -> 101.42.136.73 8443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9101480; rev:2;)
alert tls $HOME_NET any -> 101.42.255.92 8081 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100762; rev:2;)
alert tls $HOME_NET any -> 101.43.103.154 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"1d89ec9b3ac66180185a5f5e2d71e1a6941301fdf23bf51ce6d642d68e376af0"; reference:url,publicmosaic.com/indicators; sid:9100798; rev:2;)
alert tls $HOME_NET any -> 101.126.10.34 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100216; rev:2;)
alert tls $HOME_NET any -> 101.200.29.195 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"c036251d25dca54531448afcfb7517bb1951fecff56afff1b62bf42b8ae6981d"; reference:url,publicmosaic.com/indicators; sid:9103375; rev:2;)
alert tls $HOME_NET any -> 101.200.85.0 8443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"8848f4cc93d21742dd71884c06aaa159bf143b186ab5e9ed1f822fdcd8f0d489"; reference:url,publicmosaic.com/indicators; sid:9103420; rev:2;)
alert tls $HOME_NET any -> 101.200.193.211 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"cfa98cd4addeae494b424f879bd300b40028f996153159abfff78d96ca2b2cdf"; reference:url,publicmosaic.com/indicators; sid:9100748; rev:2;)
alert tls $HOME_NET any -> 101.201.103.158 8066 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9105019; rev:2;)
alert tls $HOME_NET any -> 101.201.103.158 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"98b44f7822edba8b4e4d3f6ec822ce46a32013fdf4648793972125e2926c4da2"; reference:url,publicmosaic.com/indicators; sid:9105822; rev:2;)
alert tls $HOME_NET any -> 101.201.109.2 18443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"b04a32445023dbc098ced430f4947a50d7894388f3a599d8a5b057e8cb6b671d"; reference:url,publicmosaic.com/indicators; sid:9103424; rev:2;)
alert tls $HOME_NET any -> 102.203.116.201 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"a48a67199bb81b08e1c7fe51d81e0487d4817b7a763f1f8ea79cb76415428c82"; reference:url,publicmosaic.com/indicators; sid:9105170; rev:2;)
alert tls $HOME_NET any -> 103.6.169.62 18443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9101584; rev:2;)
alert tls $HOME_NET any -> 103.12.148.37 24871 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c376478"; reference:url,publicmosaic.com/indicators; sid:9103401; rev:2;)
alert tls $HOME_NET any -> 103.27.111.130 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"594f3a1eabc130bc5b1dc9565789d7617aa1a59cc5e3428b6542dc9106b20a26"; reference:url,publicmosaic.com/indicators; sid:9105003; rev:2;)
alert tls $HOME_NET any -> 103.119.47.222 35203 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9105341; rev:2;)
alert tls $HOME_NET any -> 103.204.174.212 18443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"943ef99b67f5b8e1b095c82937df87097bace0c5cd31eb7538842446fff2bf56"; reference:url,publicmosaic.com/indicators; sid:9105548; rev:2;)
alert tls $HOME_NET any -> 103.212.186.85 8888 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9104521; rev:2;)
alert tls $HOME_NET any -> 104.168.102.116 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9101479; rev:2;)
alert tls $HOME_NET any -> 104.168.102.116 8443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9101711; rev:2;)
alert tls $HOME_NET any -> 106.15.10.2 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"566826077b3c473fb10a0041e6a80ec5b9e725520c44956a6b9a23273711f025"; reference:url,publicmosaic.com/indicators; sid:9101507; rev:2;)
alert tls $HOME_NET any -> 106.53.61.9 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100199; rev:2;)
alert tls $HOME_NET any -> 106.54.21.74 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9103969; rev:2;)
alert tls $HOME_NET any -> 106.55.25.253 8090 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9101528; rev:2;)
alert tls $HOME_NET any -> 106.55.46.152 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9105697; rev:2;)
alert tls $HOME_NET any -> 106.55.47.62 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9105696; rev:2;)
alert tls $HOME_NET any -> 106.55.255.139 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"f20fdf83bcc591cc33b586aa9a80af855be12fce8743ed3df6972d147f4e61b8"; reference:url,publicmosaic.com/indicators; sid:9103374; rev:2;)
alert tls $HOME_NET any -> 106.75.249.202 6666 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100215; rev:2;)
alert tls $HOME_NET any -> 106.75.249.202 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c376478"; reference:url,publicmosaic.com/indicators; sid:9100240; rev:2;)
alert tls $HOME_NET any -> 106.75.249.202 55413 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9103400; rev:2;)
alert tls $HOME_NET any -> 107.148.237.76 10 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c376478"; reference:url,publicmosaic.com/indicators; sid:9103399; rev:2;)
alert tls $HOME_NET any -> 108.61.192.191 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"7e12a25c8341f5363079451453b80ffa766703c669118f3d917bf8e737a38bbf"; reference:url,publicmosaic.com/indicators; sid:9103384; rev:2;)
alert tls $HOME_NET any -> 109.236.50.145 5093 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"64257fc0fac31c01a5ccd816c73ea86e639260da1604d04db869bb603c2886e6"; reference:url,publicmosaic.com/indicators; sid:9105205; rev:2;)
alert tls $HOME_NET any -> 111.228.4.54 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"27e65a5fa9510a489a79890a1ebdc5551f6a0ebf106c99b8d09e1a80bbc94de7"; reference:url,publicmosaic.com/indicators; sid:9100022; rev:2;)
alert tls $HOME_NET any -> 111.228.5.127 5435 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9106658; rev:2;)
alert tls $HOME_NET any -> 111.228.55.96 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100214; rev:2;)
alert tls $HOME_NET any -> 111.228.55.96 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c376478"; reference:url,publicmosaic.com/indicators; sid:9100236; rev:2;)
alert tls $HOME_NET any -> 111.229.248.198 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"e981f151df775275d2f96c564994f0c16b45fa7d5588889f9514e4f7568a3c40"; reference:url,publicmosaic.com/indicators; sid:9105162; rev:2;)
alert tls $HOME_NET any -> 111.231.116.164 4443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9104128; rev:2;)
alert tls $HOME_NET any -> 111.231.116.164 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"2e6ae8fd916ca2c383676b0a0feeaecad1332056689b142fce2275c5e1c7e675"; reference:url,publicmosaic.com/indicators; sid:9105168; rev:2;)
alert tls $HOME_NET any -> 112.124.22.77 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"e897ac88ce5cffa5904613368cfebd9b4fe915a3376bcae2f8d3ab59b268675d"; reference:url,publicmosaic.com/indicators; sid:9105183; rev:2;)
alert tls $HOME_NET any -> 113.45.253.80 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100722; rev:2;)
alert tls $HOME_NET any -> 113.52.135.27 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"4bc5cc527529266c9be1443b5249d49728b179ff5f01b594d45d9d98dccf88a0"; reference:url,publicmosaic.com/indicators; sid:9100239; rev:2;)
alert tls $HOME_NET any -> 113.250.188.15 6784 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9105020; rev:2;)
alert tls $HOME_NET any -> 113.250.188.15 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c376478"; reference:url,publicmosaic.com/indicators; sid:9100238; rev:2;)
alert tls $HOME_NET any -> 114.132.46.254 8444 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9104182; rev:2;)
alert tls $HOME_NET any -> 114.132.216.210 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9105695; rev:2;)
alert tls $HOME_NET any -> 114.215.188.153 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"5872f049081ab305513fcac0975be27712414a73d28e3105a143bd54f664ed3d"; reference:url,publicmosaic.com/indicators; sid:9106771; rev:2;)
alert tls $HOME_NET any -> 115.159.226.190 54321 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"2a7bbea987b1d5ddd1cff5ce3196c873c6aff882fea8773a3e53c6281167e0c6"; reference:url,publicmosaic.com/indicators; sid:9105468; rev:2;)
alert tls $HOME_NET any -> 115.190.161.178 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"cfdbb225cdc04a0f2061fe533d8945c2e387fa65466ae3c033f0675aa56c0ba0"; reference:url,publicmosaic.com/indicators; sid:9100025; rev:2;)
alert tls $HOME_NET any -> 116.198.233.179 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"b2be0564060a05d714e6c0f2a0578fc52968b25a3070f4c461a653815dec2afa"; reference:url,publicmosaic.com/indicators; sid:9100231; rev:2;)
alert tls $HOME_NET any -> 116.204.119.99 52034 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"c03904028e11ec0fa2cf303ad8b00b6ceb78463b31fa0eae5333d87c2e79fae4"; reference:url,publicmosaic.com/indicators; sid:9105184; rev:2;)
alert tls $HOME_NET any -> 117.50.184.221 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56befb4150df0acb258b54bdf34115995e0dc11a6b0b0fcff5e4974acd2adc21"; reference:url,publicmosaic.com/indicators; sid:9105148; rev:2;)
alert tls $HOME_NET any -> 117.72.181.104 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100417; rev:2;)
alert tls $HOME_NET any -> 117.72.182.5 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100186; rev:2;)
alert tls $HOME_NET any -> 117.72.242.9 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"a7660630f6c0bf27970e2930fdfe416358004a3e5c04ecad4e5184e48389b561"; reference:url,publicmosaic.com/indicators; sid:9100230; rev:2;)
alert tls $HOME_NET any -> 118.24.42.214 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100207; rev:2;)
alert tls $HOME_NET any -> 118.25.100.71 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"64257fc0fac31c01a5ccd816c73ea86e639260da1604d04db869bb603c2886e6"; reference:url,publicmosaic.com/indicators; sid:9105825; rev:2;)
alert tls $HOME_NET any -> 118.89.79.131 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"5222d6b53b3d9e67aa5acd3ce944951ef75c02cafafa212462e27b04dd8fec31"; reference:url,publicmosaic.com/indicators; sid:9100021; rev:2;)
alert tls $HOME_NET any -> 119.45.160.160 8889 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100200; rev:2;)
alert tls $HOME_NET any -> 119.45.160.160 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"de92cc976b7815a39df9039b130a51a7472df49ff0111c9d4c0c62209664e573"; reference:url,publicmosaic.com/indicators; sid:9100008; rev:2;)
alert tls $HOME_NET any -> 119.45.225.53 8888 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100823; rev:2;)
alert tls $HOME_NET any -> 119.45.225.53 8889 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100700; rev:2;)
alert tls $HOME_NET any -> 120.53.238.38 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100204; rev:2;)
alert tls $HOME_NET any -> 120.55.3.157 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"73291204314b17a1f060f1276cf8d2761074c0b56193f5f9b24bfe25bc476582"; reference:url,publicmosaic.com/indicators; sid:9100010; rev:2;)
alert tls $HOME_NET any -> 120.55.93.58 10080 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"42cf4165567f6b3a251e67d194b873dffc50d1f6a07d5a98b492a1bb4572d141"; reference:url,publicmosaic.com/indicators; sid:9105169; rev:2;)
alert tls $HOME_NET any -> 120.76.143.184 8899 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"6a93803e14de2b423a28e7a49e19bcc6e12bc030f0f55b998af6f099f5802dc7"; reference:url,publicmosaic.com/indicators; sid:9100273; rev:2;)
alert tls $HOME_NET any -> 120.77.254.122 8888 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"25d7a38dadc1817460f942199509ca2a115fa0d07ca8d4338333c1dcd7e4d43c"; reference:url,publicmosaic.com/indicators; sid:9105828; rev:2;)
alert tls $HOME_NET any -> 120.79.64.164 50040 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"321ca611b00b3c7c30826456335d02c2341ca7f20cf8e80800524aa212206ba6"; reference:url,publicmosaic.com/indicators; sid:9103378; rev:2;)
alert tls $HOME_NET any -> 121.4.38.18 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100274; rev:2;)
alert tls $HOME_NET any -> 121.40.37.49 20086 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c376478"; reference:url,publicmosaic.com/indicators; sid:9106656; rev:2;)
alert tls $HOME_NET any -> 122.51.16.188 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c376478"; reference:url,publicmosaic.com/indicators; sid:9100721; rev:2;)
alert tls $HOME_NET any -> 124.220.59.145 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"3bb792cfe4157602990f6c7005005eb2dd36985887a48d926e723a4c00ec40d6"; reference:url,publicmosaic.com/indicators; sid:9105193; rev:2;)
alert tls $HOME_NET any -> 124.222.28.189 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"260adc9c616bf84d13019a0e3e51ba83464461df35b014ce516cd9789b864a49"; reference:url,publicmosaic.com/indicators; sid:9100229; rev:2;)
alert tls $HOME_NET any -> 124.222.57.34 8081 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c376478"; reference:url,publicmosaic.com/indicators; sid:9102409; rev:2;)
alert tls $HOME_NET any -> 124.222.145.172 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"9c981e57dc1ec3b131ad366cb51bc9c1db73e158eb7aa5860f19e181c5dca571"; reference:url,publicmosaic.com/indicators; sid:9100016; rev:2;)
alert tls $HOME_NET any -> 124.222.209.39 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c376478"; reference:url,publicmosaic.com/indicators; sid:9100228; rev:2;)
alert tls $HOME_NET any -> 124.223.188.23 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"aca8601895a068648319a12cf0b5a0b705b1a577c231dfe8c73f9576ee667f9f"; reference:url,publicmosaic.com/indicators; sid:9105164; rev:2;)
alert tls $HOME_NET any -> 129.28.122.92 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100202; rev:2;)
alert tls $HOME_NET any -> 132.145.120.166 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"ba188f6c55e9d4d7e31f55c7cc7fee1ac0e4ed1a9771885f8c56191efe199620"; reference:url,publicmosaic.com/indicators; sid:9105154; rev:2;)
alert tls $HOME_NET any -> 132.145.126.82 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"ba188f6c55e9d4d7e31f55c7cc7fee1ac0e4ed1a9771885f8c56191efe199620"; reference:url,publicmosaic.com/indicators; sid:9105149; rev:2;)
alert tls $HOME_NET any -> 134.122.203.247 5522 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c376478"; reference:url,publicmosaic.com/indicators; sid:9103377; rev:2;)
alert tls $HOME_NET any -> 136.0.213.105 8443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"fe96525f4322c19677b6142b17cdd1b8f15920641c9c7df87d47472e3f7c4bf6"; reference:url,publicmosaic.com/indicators; sid:9103398; rev:2;)
alert tls $HOME_NET any -> 137.220.194.15 23337 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9103463; rev:2;)
alert tls $HOME_NET any -> 139.196.50.117 8839 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"0b40fcf9a403fb78bbf688f3aae05f16e9ec64c6f7960fe986ddef504ad9730a"; reference:url,publicmosaic.com/indicators; sid:9104838; rev:2;)
alert tls $HOME_NET any -> 139.196.50.117 20266 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"0b40fcf9a403fb78bbf688f3aae05f16e9ec64c6f7960fe986ddef504ad9730a"; reference:url,publicmosaic.com/indicators; sid:9105181; rev:2;)
alert tls $HOME_NET any -> 139.196.111.118 13389 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c376478"; reference:url,publicmosaic.com/indicators; sid:9103457; rev:2;)
alert tls $HOME_NET any -> 139.224.3.228 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"8bdafd7262cf74edd1872c9334dc3a52fe8df4a021f3dfd1331042a9c9412977"; reference:url,publicmosaic.com/indicators; sid:9102841; rev:2;)
alert tls $HOME_NET any -> 141.255.162.234 37422 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9103412; rev:2;)
alert tls $HOME_NET any -> 142.93.51.224 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"2e627a8af8d9791b8b5bd88e194a94478ad4c4e3db2cae2d1f8854de1c248459"; reference:url,publicmosaic.com/indicators; sid:9103397; rev:2;)
alert tls $HOME_NET any -> 146.70.232.107 5093 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"64257fc0fac31c01a5ccd816c73ea86e639260da1604d04db869bb603c2886e6"; reference:url,publicmosaic.com/indicators; sid:9100720; rev:2;)
alert tls $HOME_NET any -> 146.103.124.85 402 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56dab4e372255e8afe40700748ea200dc9083f61c1f6f1140095fa2265dfcd79"; reference:url,publicmosaic.com/indicators; sid:9103396; rev:2;)
alert tls $HOME_NET any -> 149.50.116.109 10000 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9106212; rev:2;)
alert tls $HOME_NET any -> 150.158.102.111 1235 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9102808; rev:2;)
alert tls $HOME_NET any -> 150.158.102.111 5005 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c376478"; reference:url,publicmosaic.com/indicators; sid:9102807; rev:2;)
alert tls $HOME_NET any -> 151.244.228.91 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"b2c48b913336ad29c90bc6efb0e021b3da558bc8e9eb23d87df805b7bf8ac290"; reference:url,publicmosaic.com/indicators; sid:9104835; rev:2;)
alert tls $HOME_NET any -> 151.245.195.160 45454 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"19cdfae4bf0873a66a619eb18e487549f43af6acf4ba5f73558873557d486fdd"; reference:url,publicmosaic.com/indicators; sid:9105179; rev:2;)
alert tls $HOME_NET any -> 152.32.132.82 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100203; rev:2;)
alert tls $HOME_NET any -> 152.136.253.101 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"4b63b8f6c095f1a064d1722f591dbe89027101bcfc6aa982e4cc22a92a22d9f7"; reference:url,publicmosaic.com/indicators; sid:9104845; rev:2;)
alert tls $HOME_NET any -> 154.38.114.115 53450 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"2eb11cde7b722162d7a070b1ac06a57c83a01061cf4e86cc59f42182854bba53"; reference:url,publicmosaic.com/indicators; sid:9103383; rev:2;)
alert tls $HOME_NET any -> 154.91.85.44 8443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"a4de923068bb0a11ce990480e4cf5ce068185f6e8fe13890cb4925260e49e3ec"; reference:url,publicmosaic.com/indicators; sid:9100416; rev:2;)
alert tls $HOME_NET any -> 154.219.115.123 61443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"1ad6642fff4b89123bdc35000ed53ef57322284a397ffc988bd5fe86594d01ce"; reference:url,publicmosaic.com/indicators; sid:9103423; rev:2;)
alert tls $HOME_NET any -> 154.221.25.38 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100201; rev:2;)
alert tls $HOME_NET any -> 155.94.154.152 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"69eb915c0664991b382f997c487479c2e25dcec46a3f392d0824d4c1d3337c4d"; reference:url,publicmosaic.com/indicators; sid:9105165; rev:2;)
alert tls $HOME_NET any -> 156.40.156.39 8443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"891340c83944973221766514afac9e69c2e7684cf34dcf413ef4631430ef7ab7"; reference:url,publicmosaic.com/indicators; sid:9100227; rev:2;)
alert tls $HOME_NET any -> 156.225.18.45 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"44d5c678203a9049263523d1ee53db834cba5e23e8a7fbc0376b1bf0b53ad682"; reference:url,publicmosaic.com/indicators; sid:9105188; rev:2;)
alert tls $HOME_NET any -> 156.226.182.190 50017 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"4ccc1ca04423f48343254b63c49ea1b853fd508a37e65bad0d2a61c78f90c295"; reference:url,publicmosaic.com/indicators; sid:9103387; rev:2;)
alert tls $HOME_NET any -> 156.239.252.191 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"bcf512078e6c9a5bfd38514b268df56c6ec11527eff5d808bb4a20e2599f7b8d"; reference:url,publicmosaic.com/indicators; sid:9105161; rev:2;)
alert tls $HOME_NET any -> 157.66.26.124 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87a61d62f0f2664fd42c7d0da60dbf47ed05f18bb89cf81ababe3065959d14fd"; reference:url,publicmosaic.com/indicators; sid:9100226; rev:2;)
alert tls $HOME_NET any -> 157.230.253.244 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"55c7b1e2f0bb95fba6084d797725661cac4c9128870b2f4da2b60f93221dc2e3"; reference:url,publicmosaic.com/indicators; sid:9105192; rev:2;)
alert tls $HOME_NET any -> 158.94.210.131 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"42c6ba12623518c31b561c881a13a458bcabfcdc67ad638f0bc940f54bd8d884"; reference:url,publicmosaic.com/indicators; sid:9104127; rev:2;)
alert tls $HOME_NET any -> 158.94.210.131 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"1e78cc9e4f2ef06f8411549857b5474e708e15a49c76bae019fab362661c6210"; reference:url,publicmosaic.com/indicators; sid:9105820; rev:2;)
alert tls $HOME_NET any -> 158.101.136.18 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"ba188f6c55e9d4d7e31f55c7cc7fee1ac0e4ed1a9771885f8c56191efe199620"; reference:url,publicmosaic.com/indicators; sid:9105157; rev:2;)
alert tls $HOME_NET any -> 159.75.123.199 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"7ab5234af0080bc02d0f398a42905ecc9a81c6f01c3c64f196a2383cbe331b4c"; reference:url,publicmosaic.com/indicators; sid:9100015; rev:2;)
alert tls $HOME_NET any -> 161.97.185.123 1478 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"fb2de06b98b8a1eae876621c9d4a147dc0c3cfa77b25ed82f9663d4e1e6c1eef"; reference:url,publicmosaic.com/indicators; sid:9105178; rev:2;)
alert tls $HOME_NET any -> 162.251.92.64 54189 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"8eb3c6aa7bffd194e18251531bd2d93066ec6c5414dfabe716e2a80c8177c867"; reference:url,publicmosaic.com/indicators; sid:9104255; rev:2;)
alert tls $HOME_NET any -> 165.99.43.101 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"b95be8dc7cb1889ef7961f80f18e9e790d077aac0791cc0860ca0d4e17e3b71b"; reference:url,publicmosaic.com/indicators; sid:9105819; rev:2;)
alert tls $HOME_NET any -> 167.17.47.252 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9104256; rev:2;)
alert tls $HOME_NET any -> 167.17.47.252 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"5d8b7ada3a4f9e2e98214f7378a3823a4509f0c7dd7e38a71b2b9cdcd7e761e6"; reference:url,publicmosaic.com/indicators; sid:9105818; rev:2;)
alert tls $HOME_NET any -> 167.160.189.206 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"50976afa22d82152a649fb47c70b68477089076ce14bdf600a0e2889ab52fa5e"; reference:url,publicmosaic.com/indicators; sid:9105191; rev:2;)
alert tls $HOME_NET any -> 169.239.128.43 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"5817fce2367ee0d824c34aaf1def44b4b50cc5efa76f9c577ecdbab445605fa0"; reference:url,publicmosaic.com/indicators; sid:9105190; rev:2;)
alert tls $HOME_NET any -> 169.239.128.43 50443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9103422; rev:2;)
alert tls $HOME_NET any -> 172.232.97.189 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"2cc7903b9f7dc87e59a32dbf2f608f8f7205a3e230084ac6b1588069fe8a17c4"; reference:url,publicmosaic.com/indicators; sid:9100791; rev:2;)
alert tls $HOME_NET any -> 173.208.167.73 3906 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9103395; rev:2;)
alert tls $HOME_NET any -> 173.208.167.73 39001 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9103394; rev:2;)
alert tls $HOME_NET any -> 173.208.167.73 39002 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9103393; rev:2;)
alert tls $HOME_NET any -> 173.208.167.73 39003 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9103392; rev:2;)
alert tls $HOME_NET any -> 173.208.167.73 39004 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9103391; rev:2;)
alert tls $HOME_NET any -> 173.208.167.73 39005 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9103390; rev:2;)
alert tls $HOME_NET any -> 175.27.214.144 4433 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100699; rev:2;)
alert tls $HOME_NET any -> 175.27.214.144 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c376478"; reference:url,publicmosaic.com/indicators; sid:9100719; rev:2;)
alert tls $HOME_NET any -> 175.178.230.164 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100198; rev:2;)
alert tls $HOME_NET any -> 176.123.9.232 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100094; rev:2;)
alert tls $HOME_NET any -> 178.32.16.167 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9106070; rev:2;)
alert tls $HOME_NET any -> 178.157.59.195 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"8619c38485b42e06e6b16257fe1e1bb4ac7ee799eddebff460016864c03df6be"; reference:url,publicmosaic.com/indicators; sid:9100225; rev:2;)
alert tls $HOME_NET any -> 179.61.227.241 300 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"cb9f9278cb08283dae7a50015a543cd7d808dc0103088bd710b57d63ecb0ccb0"; reference:url,publicmosaic.com/indicators; sid:9103389; rev:2;)
alert tls $HOME_NET any -> 180.76.141.175 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c376478"; reference:url,publicmosaic.com/indicators; sid:9100224; rev:2;)
alert tls $HOME_NET any -> 180.76.250.42 16379 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"d29d81d81d1d411cd25c90153c35eb0cf181b4ff57e9206671192859b19f75c0"; reference:url,publicmosaic.com/indicators; sid:9102679; rev:2;)
alert tls $HOME_NET any -> 180.184.46.116 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c376478"; reference:url,publicmosaic.com/indicators; sid:9105824; rev:2;)
alert tls $HOME_NET any -> 182.255.91.197 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"4d511d5a51b5b2587ef1fdbbd0367b7c476fb8616463fb6f7117e735e35daffb"; reference:url,publicmosaic.com/indicators; sid:9105186; rev:2;)
alert tls $HOME_NET any -> 183.60.226.2 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"bff0c08b690cc3c1043648abad4ddf6c88a08d6b79feaff6b5892b3f24b7876c"; reference:url,publicmosaic.com/indicators; sid:9105189; rev:2;)
alert tls $HOME_NET any -> 185.28.119.238 3455 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"9a3fb228c69b077959a4bc82a8a59bd69c0e311075bd47fd737b3f60b9efe1e7"; reference:url,publicmosaic.com/indicators; sid:9105177; rev:2;)
alert tls $HOME_NET any -> 188.227.14.105 541 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9103415; rev:2;)
alert tls $HOME_NET any -> 191.223.41.183 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9103468; rev:2;)
alert tls $HOME_NET any -> 192.36.39.61 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"fbf0342c763a9d741d498d6b48e486975ea0b5998a341f3c340954f97987a079"; reference:url,publicmosaic.com/indicators; sid:9106220; rev:2;)
alert tls $HOME_NET any -> 192.144.171.134 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100257; rev:2;)
alert tls $HOME_NET any -> 192.252.179.24 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100195; rev:2;)
alert tls $HOME_NET any -> 192.252.185.78 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100193; rev:2;)
alert tls $HOME_NET any -> 193.37.69.43 50059 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"b397a3758b6f377ace290bc6a2ba3d3d4ce166c1fec69f97b1d13baf37070366"; reference:url,publicmosaic.com/indicators; sid:9106066; rev:2;)
alert tls $HOME_NET any -> 193.112.191.222 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100197; rev:2;)
alert tls $HOME_NET any -> 193.239.86.192 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"13bf37de8239abb8a59da091445f1fedeb2de35f3fb0c930007b513c7efef161"; reference:url,publicmosaic.com/indicators; sid:9104125; rev:2;)
alert tls $HOME_NET any -> 193.239.86.193 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"13bf37de8239abb8a59da091445f1fedeb2de35f3fb0c930007b513c7efef161"; reference:url,publicmosaic.com/indicators; sid:9104124; rev:2;)
alert tls $HOME_NET any -> 196.251.121.183 4433 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"4e5afc5fc22bad975bc1fca7517522d90f1248b979fd585467d40fadcf0d0b9d"; reference:url,publicmosaic.com/indicators; sid:9101262; rev:2;)
alert tls $HOME_NET any -> 198.23.196.130 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9103388; rev:2;)
alert tls $HOME_NET any -> 198.199.72.177 7771 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"e10fb7c4f468cdcb4de1e00e4ff150f151c3a7bfea6c62109dd2c84816f990b2"; reference:url,publicmosaic.com/indicators; sid:9100223; rev:2;)
alert tls $HOME_NET any -> 198.199.72.177 9900 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"ea78db19c584fef1610bd5da7007da6487118d4e196d5eef62673c42b13a2f9e"; reference:url,publicmosaic.com/indicators; sid:9100269; rev:2;)
alert tls $HOME_NET any -> 203.91.75.89 5006 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9105016; rev:2;)
alert tls $HOME_NET any -> 207.57.134.202 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"8848f4cc93d21742dd71884c06aaa159bf143b186ab5e9ed1f822fdcd8f0d489"; reference:url,publicmosaic.com/indicators; sid:9100725; rev:2;)
alert tls $HOME_NET any -> 209.200.246.194 17568 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9104526; rev:2;)
alert tls $HOME_NET any -> 209.200.246.194 32126 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100066; rev:2;)
alert tls $HOME_NET any -> 209.200.246.194 36843 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"7b49fc589e7e738e3457859d269996ecef83f693570b0ac482c426b1fa04bd73"; reference:url,publicmosaic.com/indicators; sid:9104524; rev:2;)
alert tls $HOME_NET any -> 209.200.246.194 37865 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"a787f037d1730147e13cc8835ebd0b8d749b59d1be5e86cade5e4a3e68b70eed"; reference:url,publicmosaic.com/indicators; sid:9104523; rev:2;)
alert tls $HOME_NET any -> 210.56.48.227 8081 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c376478"; reference:url,publicmosaic.com/indicators; sid:9100194; rev:2;)
alert tls $HOME_NET any -> 212.14.244.222 809 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9103462; rev:2;)
alert tls $HOME_NET any -> 216.203.20.232 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"568787644b3707614f9990ee91ba155dca72edb482cb3d89fd5006675310bca8"; reference:url,publicmosaic.com/indicators; sid:9101463; rev:2;)
alert tls $HOME_NET any -> 217.154.212.25 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"30d01468fc847356eec11870a38e95f725c8087c25ab1ab9cfd27cfdd1401aeb"; reference:url,publicmosaic.com/indicators; sid:9105187; rev:2;)
alert tls $HOME_NET any -> 218.244.142.4 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"aa6feed05dd52a236a440bbf777d0922ccec190001b1f07ad476c63cd7cc56fa"; reference:url,publicmosaic.com/indicators; sid:9101506; rev:2;)
alert tls $HOME_NET any -> 222.80.159.10 8443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"495081da58b2530b089cd1dc02269754f9940e98a295fac12117201e706012ab"; reference:url,publicmosaic.com/indicators; sid:9103417; rev:2;)
alert tls $HOME_NET any -> 222.255.215.42 30005 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100196; rev:2;)
alert tls $HOME_NET any -> 222.255.215.42 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"4d7a055b35f3834e2fec4625f3a0738a5e206f1e3bb818b4b823799daf551183"; reference:url,publicmosaic.com/indicators; sid:9100222; rev:2;)
alert tls $HOME_NET any -> 223.109.142.7 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9104123; rev:2;)
alert tls $HOME_NET any -> 223.109.142.7 8443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9104122; rev:2;)
alert tls $HOME_NET any -> 223.109.142.7 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"5a7cb28d2440574f478fe556b9995df48e369c70b27e2a5f5ab92bfa3b8652a7"; reference:url,publicmosaic.com/indicators; sid:9104254; rev:2;)