Meterpreter Reverse Shell Stage Download

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects the download of a Meterpreter reverse shell stage by looking for a specific byte sequence ('|fc e8 8f 00 00 00|') in TCP traffic flowing to the server on an established connection. This byte sequence is characteristic of the initial stage of a Meterpreter payload, which is often used for command and control.