Add files via upload

msfvenom.yar

@@ -0,0 +1,17 @@
+rule meterpreter_reverse_tcp_shellcode {
+    meta:
+        author = "FDD @ Cuckoo sandbox"
+        description = "Rule for metasploit's meterpreter reverse tcp raw shellcode"
+
+    strings:
+        $s1 = { fce8 8?00 0000 60 }     // shellcode prologue in metasploit
+        $s2 = { 648b ??30 }             // mov edx, fs:[???+0x30]
+        $s3 = { 4c77 2607 }             // kernel32 checksum
+        $s4 = "ws2_"                    // ws2_32.dll
+        $s5 = { 2980 6b00 }             // WSAStartUp checksum
+        $s6 = { ea0f dfe0 }             // WSASocket checksum
+        $s7 = { 99a5 7461 }             // connect checksum
+
+	condition:
+    		all of them
+}