Hello Habr! This is a translation of my first article, which was born due to the fact that I once played with the types of meterpreter payload from the Metasploit Framework and decided to find a way to detect it in the Windows OS family. I will try to present everything in an accessible and compact way without delving into all the work. To begin with, I decided to create the nth number of useful loads (windows/meterpreter/reverse_tcp, shell/bind_tcp, shell_hidden_bind_tcp, vncinject/reverse_tcp, cmd/windows/reverse_powershell) to analyze what will happen in the system after their injection. The shell/bind_tcp and shell_hidden_bind_tcp payloads use a bind connection as a connection, that is, we can see how an attacker connects to our ports, these payloads do not belong to meterpreter and cannot migrate between processes and do not load specific dlls into the system when they are in the system. The vncinject/reverse_tcp payload also does not use specific dlls, but when a connection is established, it starts broadcasting traffic through the browser on a port related to the VNC protocol (ports 5900+N and 5900+ N). And here are payloads having a reverse connection type windows/meterpreter/reverse_tcp and cmd/windows/reverse_powershell loaded their dll files both during startup and after migrations. And of course they opened ports. This way I will be able to get a list of dlls that are specific to these payloads: Well, after that, I decided to throw a simple script, let's look at its main methods. We declare the MeterpreterScaner class and its variables that we will need in the methods. A method that allows us to determine the OS version (I tested only on the seven and ten). We get information about the system and get only the version from it using regular regrowth. REG_FOR_WINDOWS_VERSION = r'(?:Windows\s+)(\d+|XP|\d+\.\d+)' First, we get a list of all processes with the dll we are interested in using the command CMD_TASKLIST_COMMAND = "tasklist /M dll". We find all the running ones .exe files `REG_FOR_EXE_PROCESSES = r'(?<=\r\n)[A-Za-z]+.exe\s+\d+" and fill our dictionary with them along with their process PIDs. Here we check the processes received earlier for the number of dlls from our signatures. We look at open connections with the command CMD_NETSTAT_COMMAND = 'netstat -aon |find /i "established"", filter the received information REG_FOR_LOCAL_SOCKET = r'(?:TCP\s+)(\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}:\d{1,5})" and then check the sockets. We check the dynamic ports and see that it is not localhost. If everything matches, we get data about remote soket REG_FOR_REMOTE_SOCKET = r'(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}:\d{1,5})\s+[A-Z]+\s+(\d+)' and analyze it. If the port is 4444, then it is 99.(9)% that this is the payload because this port is used in MSF by default. It was also possible to add a VNC check, but I think you can add one condition =) Well, at the end of the method that runs this whole script. In this article, I tried to describe a way to detect reverse payloads of meterpreter. I also analyzed the scripts that I could find and wrote a script to detect meterpreter in a memory dump, if you are interested, I can write about it next time. Also, if you know other signatures or detection methods, write about them in the comments. I will also leave [a link to the project] (https://github.com/OverPotter/MeterpreterScanner ) and thank you for your time. Python Developer