17 lines
523 B
Text
17 lines
523 B
Text
|
rule Meterpreter_rev_tcp
|
||
|
|
{
|
||
|
|
meta:
|
||
|
|
description = "Meterpreter reverse TCP"
|
||
|
|
reference = "https://www.securityartwork.es/2015/03/20/deteccion-de-codigo-malicioso-con-yara-i/"
|
||
|
|
strings:
|
||
|
|
$ metadata "ab.exe" wide nocase
|
||
|
|
$ dll1 = "MSVCRT.dll" nocase
|
||
|
|
$ dll2 = "KERNEL32.dll" nocase
|
||
|
|
$ dll3 = "ADVAPI32.dll" nocase
|
||
|
|
$ dll4 = "WSOCK32.dll" nocase
|
||
|
|
$ dll5 = "WS2_32.dll" nocase
|
||
|
|
$ dll6 = "ntdll.dll" nocase
|
||
|
|
condition:
|
||
|
|
#metadata == 2 and all of ($ dll *)
|
||
|
|
}
|