SHELLCODE: Windows Reverse Ordered TCP Metasploit Stager Payload

This signature detects malicious reverse ordered tcp metasploit stager shellcode. A stager shellcode establishes a communication channel between the attacker and the victim and reads in a subsequent payload to execute on the remote host. Attempts to execute such shellcode indicate malicious activity.

References

URL: http://www.rapid7.com/db/modules/payload/windows/dllinject/reverse_ord_tcp http://www.rapid7.com/db/modules/payload/windows/meterpreter/reverse_ord_tcp http://www.rapid7.com/db/modules/payload/windows/patchupdllinject/reverse_ord_tcp http://www.rapid7.com/db/modules/payload/windows/patchupmeterpreter/reverse_ord_tcp http://www.rapid7.in/db/modules/payload/windows/shell/reverse_ord_tcp http://www.rapid7.com/db/modules/payload/windows/upexec/reverse_ord_tcp http://www.rapid7.com/db/modules/payload/windows/vncinject/reverse_ord_tcp

Short Name

SHELLCODE:X86:WIN-REV-ORD-TCP

Severity

Critical

Recommended

False

Recommended Action

Drop

SHELLCODE: Windows Reverse Ordered TCP Metasploit Stager Payload

References

Found a potential security threat?