mal_metasploit_shellcode_windows_shell_hidden_bind_tcp

YARA detection rule by Maxime THIEBAUT (@0xThiebaut) · NOASSERTION

Detects Metasploit import-hashes from the windows/shell_hidden_bind_tcp payload

rule mal_metasploit_shellcode_windows_shell_hidden_bind_tcp: RELEASED MALWARE BACKDOOR TA0011 T1095 {
    meta:
        id = "6HQ4oEHcqNUBbmJxwjBpVZ"
        fingerprint = "cf568dda6d7ec12ed2e9ed3f24865b92bb243cae359f3c7264c8819f4ae8a430"
        version = "1.0"
        creation_date = "2021-09-02"
        first_imported = "2023-02-23"
        last_modified = "2023-02-23"
        status = "RELEASED"
        sharing = "TLP:WHITE"
        source = "THIEBAUT.DEV"
        author = "Maxime THIEBAUT (@0xThiebaut)"
        author = "Maxime THIEBAUT (@0xThiebaut)"
        description = "Detects Metasploit import-hashes from the windows/shell_hidden_bind_tcp payload"
        category = "MALWARE"
        malware = "BACKDOOR"
        mitre_att = "T1095"
        reference = "https://blog.nviso.eu/2021/09/02/anatomy-and-disruption-of-metasploit-shellcode/"
        hash = "166a5d9715d238d7902dbc505df2b2769fa68db337a2de1405be430513f7a938"

    strings:
        $import_full    = "ws2_32"                          $import_part    = {33 32 [03] 77 73 32 5F}          $imphashes      = {
                            4c 77 26 07                             [10-30]
                            29 80 6b 00                             [10-30]
                            ea 0f df e0                             [02-20]
                            02 00                                   [05-25]
                            c2 db 37 67                             [05-25]
                            f1 a2 77 29                             [02-15]
                            b7 e9 38 ff                             [30-50]
                            94 ac be 33                             [05-25]
                            75 6e 4d 61                             [40-60]
                            79 cc 3f 86                             [05-25]
                            08 87 1d 60                             [02-15]
                            f0 b5 a2 56                             [01-10]
                            a6 95 bd 9d                             [10-30]
                            47 13 72 6f                           }
    condition:
        any of ($import_*) and $imphashes
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

46d84255-9696-4c1b-b68d-ebb8a44b6467

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion