I am learning while configuring Snort, my setup consists in an attacker (Linux), a victim (Android smartphone) and one detection system (IDS). So far, I have been able to log all the packets between the attacker and victim including the Meterpreter session. What should I do/research about if I want to detect the Meterpreter session? A little bit of packet analysis gave me a hex value for the stager. The payload used is
I want to make a rule file for detecting a Meterpreter session between those two devices. How should I proceed? It would really be helpful if someone points me in the right direction. Thanks!