Skip to content
yararules.org
Menu

YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_HKTL_Meterpreter_Inmemory

Detects Meterpreter in-memory

Hack toolMeterpreterSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X
Author
netbiosX, Florian Roth
Date
2020-06-29
Modified
2023-04-21
Score / Quality
85 / 85

What this rule detects

Detects Meterpreter in-memory

Associated malware family: Meterpreter.

It defines 7 patterns (6 text, 1 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
hktl-meterpreter-inmemory.yarDetection Rule License 1.1
rule SIGNATURE_BASE_HKTL_Meterpreter_Inmemory
{
	meta:
		description = "Detects Meterpreter in-memory"
		author = "netbiosX, Florian Roth"
		id = "29c3bb7e-4da8-5924-ada7-2f28d9352009"
		date = "2020-06-29"
		modified = "2023-04-21"
		reference = "https://www.reddit.com/r/purpleteamsec/comments/hjux11/meterpreter_memory_indicators_detection_tooling/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_metasploit_payloads.yar#L341-L363"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		logic_hash = "4b39dbcb276842a1306205cf2e51ce86b6d2aa21353d277df15f4ea3b3d97678"
		score = 85
		quality = 85
		tags = ""

	strings:
		$sxc1 = { 6D 65 74 73 72 76 2E 64 6C 6C 00 00 52 65 66 6C 
               65 63 74 69 76 65 4C 6F 61 64 65 72 }
		$sxs1 = "metsrv.x64.dll" ascii fullword
		$ss1 = "WS2_32.dll" ascii fullword
		$ss2 = "ReflectiveLoader" ascii fullword
		$fp1 = "SentinelOne" ascii wide
		$fp2 = "fortiESNAC" ascii wide
		$fp3 = "PSNMVHookMS" ascii wide

	condition:
		(1 of ( $sx* ) or 2 of ( $s* ) ) and not 1 of ( $fp* )
}

Strings (7 patterns)

IdentifierTypeValueModifiers
$sxc1hex{ 6D 65 74 73 72 76 2E 64 6C 6C 00 00 52 65 66 6C 65 63 74 69 76 65 4C 6F 61 64 65 72 }
$sxs1text"metsrv.x64.dll"ascii fullword
$ss1text"WS2_32.dll"ascii fullword
$ss2text"ReflectiveLoader"ascii fullword
$fp1text"SentinelOne"ascii wide
$fp2text"fortiESNAC"ascii wide
$fp3text"PSNMVHookMS"ascii wide

Condition

(1 of ( $sx* ) or 2 of ( $s* ) ) and not 1 of ( $fp* )

In plain words (Heuristic)

  • At least 1 patterns in ( $sx* ) must match.
  • At least 2 patterns in ( $s* ) must match.
  • At least 1 patterns in ( $fp* ) must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

Licence & attribution

Author: netbiosX, Florian Roth

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 29c3bb7e-4da8-5924-ada7-2f28d9352009

Related rules

More Meterpreter rules