mal_metasploit_shellcode_windows_powershell_tcp

YARA detection rule by Maxime THIEBAUT (@0xThiebaut) · NOASSERTION

Detects Metasploit import-hashes from the windows/powershell_bind_tcp and windows/powershell_reverse_tcp payloads

rule mal_metasploit_shellcode_windows_powershell_tcp: RELEASED MALWARE BACKDOOR TA0011 T1095 {
    meta:
        id = "6an4dnzmZYlWYU4nyMMJoM"
        fingerprint = "fc43b130e92407e09022ba96e76ce9b34266af67bef678a12eda739b7895487a"
        version = "1.0"
        creation_date = "2021-09-02"
        first_imported = "2023-02-23"
        last_modified = "2023-02-23"
        status = "RELEASED"
        sharing = "TLP:WHITE"
        source = "THIEBAUT.DEV"
        author = "Maxime THIEBAUT (@0xThiebaut)"
        description = "Detects Metasploit import-hashes from the windows/powershell_bind_tcp and windows/powershell_reverse_tcp payloads"
        category = "MALWARE"
        malware = "BACKDOOR"
        mitre_att = "T1095"
        reference = "https://blog.nviso.eu/2021/09/02/anatomy-and-disruption-of-metasploit-shellcode/"
        hash = "e26603ef85151596b0faf5ab7dc82ae655d37ec8aef204b329553cf5bc5b730b"
        hash = "9e017c8a6e0078f06dfb898721f3ef7c49f797bc8e2073ff338407dbb5a92297"

    strings:
        $imphashes      = {
                            31 8b 6f 87                             [01-20]
                            f0 b5 a2 56                             [01-20]
                            a6 95 bd 9d                             [10-30]
                            47 13 72 6f                           }
    condition:
        all of them
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

7aae361c-3cab-43f5-ab08-e4b993e203cf

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion