Signature Detail

SCAN: Metasploit Meterpreter DLL

This signature detects the Metasploit Framework meterpreter DLL being transferred from one system to another. This is generally an indication that a destination system was successfully exploited by a source system. Both hosts can be compromised and should be investigated.

Extended Description

The use of DLL extensions in a Meterpreter allows attackers to execute desired commands or code on the compromised system. The attacker may also cause network operation disruption or denial of service condition via the compromised host in a network.

References

• URL: http://trac.metasploit.com/browser/framework3/trunk/external/source/meterpreter/source/extensions/sniffer/sniffer.c?rev=6763