mal_metasploit_shellcode_windows_meterpreter_reverse_http_x86

YARA detection rule by Maxime THIEBAUT (@0xThiebaut) · NOASSERTION

Detects Metasploit import-hashes from the windows/meterpreter/reverse_http payload

rule mal_metasploit_shellcode_windows_meterpreter_reverse_http_x86: RELEASED MALWARE BACKDOOR TA0011 T1095 {
    meta:
        id = "70MTcX1QJqCy2yCgyLIa00"
        fingerprint = "acd46b57de80a4bbb074d11a7f7b5d2c5ee4f15a6f25080ddf63c976f813cb3d"
        version = "1.0"
        creation_date = "2023-03-01"
        first_imported = "2023-03-01"
        last_modified = "2023-03-01"
        status = "RELEASED"
        sharing = "TLP:WHITE"
        source = "THIEBAUT.DEV"
        author = "Maxime THIEBAUT (@0xThiebaut)"
        description = "Detects Metasploit import-hashes from the windows/meterpreter/reverse_http payload"
        category = "MALWARE"
        malware = "BACKDOOR"
        mitre_att = "T1071"
        reference = "https://blog.nviso.eu/2021/09/02/anatomy-and-disruption-of-metasploit-shellcode/"
        hash = "6675cdf56a8dbde5b5d745145ad41c7a717000d7dd03ac4baa88c8647733d0ab"

    strings:
        $LoadLibraryA   = {
                            6E 65 74 00                             [01-03]
                            77 69 6E 69                             [01-05]
                            4C 77 26 07                         }
        $InternetOpenA  = { 3a 56 79 a7 }         $imphashes      = {
                            57 89 9f c6                             [15-25]
                            eb 55 2e 3b                             [05-15]
                            2d 06 18 7b                             [05-15]
                            44 f0 35 e0                             [20-30]
                            58 a4 53 e5                             [10-20]
                            12 96 89 e2                             [30-50]
                            f0 b5 a2 56                           }
    condition:
        all of them
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

f01ee4c5-5065-4f70-9494-c733e78af9a6

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion