# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 23 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: ja4x dc020972a4a8_9fb583da09a2_fb02ba79e164 — https://publicmosaic.com/ja4x/dc020972a4a8_9fb583da09a2_fb02ba79e164
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 0
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tls $HOME_NET any -> 23.148.212.86 2053 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"63a2da031ea5cbd764cb607ee9f438d051203d3e0b793b801dd63ab01b39d4da"; reference:url,publicmosaic.com/indicators; sid:9100414; rev:2;)
alert tls $HOME_NET any -> 23.148.212.123 2053 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"ab98cb64960c77bcc8734dc53aad62d8482664b32e2d1adab74dd5004c5bc42a"; reference:url,publicmosaic.com/indicators; sid:9100018; rev:2;)
alert tls $HOME_NET any -> 41.216.189.62 2096 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"ca9b98a5aa776d129cfdc1486c947408ca05acb22359872ab526c7182ab90491"; reference:url,publicmosaic.com/indicators; sid:9100680; rev:2;)
alert tls $HOME_NET any -> 43.155.169.245 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"c099f52af0291822650ff4444a77c5913e8394a56f992456a339095dbf0d6205"; reference:url,publicmosaic.com/indicators; sid:9100011; rev:2;)
alert tls $HOME_NET any -> 45.87.53.6 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"6a926e83b7c8667794f9b64f60a162e951a851b7647ab16097d539f7c466acda"; reference:url,publicmosaic.com/indicators; sid:9100250; rev:2;)
alert tls $HOME_NET any -> 45.87.53.6 8443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"6a926e83b7c8667794f9b64f60a162e951a851b7647ab16097d539f7c466acda"; reference:url,publicmosaic.com/indicators; sid:9100249; rev:2;)
alert tls $HOME_NET any -> 47.83.3.103 10443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"858ae53e03c0c0dbd14f8df3b9fccb7c0e8a9577beef5c05e3ad3f1cc529c9ae"; reference:url,publicmosaic.com/indicators; sid:9103418; rev:2;)
alert tls $HOME_NET any -> 87.232.84.18 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"d9921903ec8abbc70101a107ee6faba8babe61dd83a88cf3a5983d1afbe7d9d7"; reference:url,publicmosaic.com/indicators; sid:9100612; rev:2;)
alert tls $HOME_NET any -> 101.33.202.134 9989 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"d8b7e9e089cc0fc66e988aaaf5cbfcb273cc0d1b9a0adf023210dbfdb0d26cf2"; reference:url,publicmosaic.com/indicators; sid:9102188; rev:2;)
alert tls $HOME_NET any -> 107.172.217.220 12096 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"4f2bbac45d2d9766d28ef47cf52da81f7aab5b64cfb03bce4ced0e264a997bed"; reference:url,publicmosaic.com/indicators; sid:9104846; rev:2;)
alert tls $HOME_NET any -> 111.229.4.108 2096 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"89db360aff192a136b98a247e5f071a68709f43f0d472d6be6c2982faae49384"; reference:url,publicmosaic.com/indicators; sid:9100420; rev:2;)
alert tls $HOME_NET any -> 151.236.21.109 2096 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"eb4fe8d8f0727ffe8adcd85213b252b17aa6b2f0390b27599b96948553193ac8"; reference:url,publicmosaic.com/indicators; sid:9105144; rev:2;)
alert tls $HOME_NET any -> 154.12.90.231 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"a927566bf9c09ac8e2761f5cbaa4ea8a662f28393f879bcba6c028c4c5beaa4c"; reference:url,publicmosaic.com/indicators; sid:9100175; rev:2;)
alert tls $HOME_NET any -> 154.94.224.35 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"64c15c562b33b226ff24a42c213e09710216c853b652a078e92c37fc45246fcc"; reference:url,publicmosaic.com/indicators; sid:9103983; rev:2;)
alert tls $HOME_NET any -> 154.94.224.35 2087 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"64c15c562b33b226ff24a42c213e09710216c853b652a078e92c37fc45246fcc"; reference:url,publicmosaic.com/indicators; sid:9100031; rev:2;)
alert tls $HOME_NET any -> 154.205.145.109 2096 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"dbe90fd89cbee0bf150ba06ce226ddcf817caca14991bd188484da3368311abe"; reference:url,publicmosaic.com/indicators; sid:9105143; rev:2;)
alert tls $HOME_NET any -> 155.117.155.141 8443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"b8466a53c646b3cea2fc730fa527639c5711a6e62de9a3f0770e2fa420210b19"; reference:url,publicmosaic.com/indicators; sid:9101454; rev:2;)
alert tls $HOME_NET any -> 165.154.225.239 8443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"24962e5e84167aaceb1899cc10660ba7156a150a0be213c6dec655362d39dc32"; reference:url,publicmosaic.com/indicators; sid:9100251; rev:2;)
alert tls $HOME_NET any -> 165.154.225.239 53111 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"24962e5e84167aaceb1899cc10660ba7156a150a0be213c6dec655362d39dc32"; reference:url,publicmosaic.com/indicators; sid:9103941; rev:2;)
alert tls $HOME_NET any -> 167.172.142.69 443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"561263fe6c1059e3231a46eb234b8aa7aceef27ee5097e7f6289d80ce38fd843"; reference:url,publicmosaic.com/indicators; sid:9106189; rev:2;)
alert tls $HOME_NET any -> 193.239.85.15 2083 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"e9025bad27db7a56ebf023264b9bc100e14ca5922db1dbbe1eecd73dc9b89d72"; reference:url,publicmosaic.com/indicators; sid:9105142; rev:2;)
alert tls $HOME_NET any -> 210.2.169.213 443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"314bf0f2c8a1f96e82fa91803bf7dea1dfb465fa2c54d47590a93dd97a60cdfe"; reference:url,publicmosaic.com/indicators; sid:9103661; rev:2;)
alert tls $HOME_NET any -> 216.238.54.156 443 (msg:"HOLLOWPOINT C2 btmob"; tls.cert_fingerprint; content:"699c8228cd8b560af29d3b48a51dac24aae697b17c85ac5a8cd1c4fda5fb19bf"; reference:url,publicmosaic.com/indicators; sid:9101537; rev:2;)