Detects meterpreter payloads in memory.

meterpreter.yara

rule Meterpreter { 
  meta: 
    author = "Kevin Wang" 
    description = "Meterpreter reverse shell in memory detecter." 
  strings: 
    $a = "metsrv.dll"
    $b = "stdapi_" 
    $c = "priv_fs"
  condition: 
    $a and $b and $c
  }