Yara rule to detect C3 shellcode in-memory based on known strings

c3_reflective_dll_artefacts.yara

rule C3_reflective_dll_artefact {
	meta:
		description = "C3 Reflective DLL Artefacts"
		author = "ajpc500"
		date = "2021-06-09"
	strings:
		$s1 = "NodeRelayDll_r64.dll" 
		$s2 = "NodeRelayDll_r86.dll"
		$sx = "StartNodeRelay"
		
	condition:
		($s1 or $s2) and $sx
}