dmknght · December 30, 2022 10:39 · dmknght · Dec 30, 2022 · dmknght · Dec 30, 2022
diff --git a/meterpreter.yara b/meterpreter.yara
 rule elf64_meterpreter_revtcp_raw {
  meta:
    description = "Detect Meterpreter ELF 64 staged reverse TCP no encoders"
  strings:
    $ = {6a 22 [4] 0f 05 [10] 6a 29 [8] 0f 05}
  condition:
    all of them
 }
	rule elf64_meterpreter_revtcp_raw {
	meta:
	description = "Detect Meterpreter ELF 64 staged reverse TCP no encoders"
	strings:
	$ = {6a 22 [4] 0f 05 [10] 6a 29 [8] 0f 05}
	condition:
	all of them
	}