Skip to content

Instantly share code, notes, and snippets.

@ajpc500
Created June 16, 2021 20:06
Show Gist options
  • Save ajpc500/9ae6eb427375438f906b0bf394813bc5 to your computer and use it in GitHub Desktop.
Save ajpc500/9ae6eb427375438f906b0bf394813bc5 to your computer and use it in GitHub Desktop.
Yara rule to detect C3 shellcode in-memory based on known strings
rule C3_reflective_dll_artefact {
meta:
description = "C3 Reflective DLL Artefacts"
author = "ajpc500"
date = "2021-06-09"
strings:
$s1 = "NodeRelayDll_r64.dll"
$s2 = "NodeRelayDll_r86.dll"
$sx = "StartNodeRelay"
condition:
($s1 or $s2) and $sx
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment