ThreatFox: Meterpreter IOCs

Hunt Hypothesis

This hunt targets adversary behavior characterized by the deployment of Meterpreter implants to establish persistent command-and-control channels and execute lateral movement within the network. Proactively hunting for these specific IOCs in Azure Sentinel is critical because early detection of Meterpreter activity allows the SOC team to disrupt advanced post-exploitation phases before attackers can exfiltrate sensitive data or escalate privileges.

IOC Summary

Malware Family: Meterpreter Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Meterpreter
let malicious_ips = dynamic(["168.245.203.140", "168.245.203.179"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["168.245.203.140", "168.245.203.179"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Meterpreter

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Meterpreter IOCs detection rule, tailored for an enterprise environment:

• Endpoint Management Software Updates

  • Scenario: Enterprise deployment of endpoint protection suites (e.g., CrowdStrike Falcon, Carbon Black, or SentinelOne) often utilizes a bundled C# or .NET agent that includes a Meterpreter-based module for remote command execution and file transfer during scheduled patching cycles. The detection logic may flag the legitimate C:\Program Files\EndpointAgent\meterpreter.exe process spawning network connections to internal management servers as suspicious IOCs.
  • Filter/Exclusion: Create an exclusion rule based on the File Hash (SHA-256) of the known vendor agent binary and restrict the alert scope to processes originating from the C:\Program Files\EndpointAgent\ directory path.

• IT Helpdesk Remote Support Sessions

  • Scenario: IT support staff utilize remote control tools like TeamViewer, AnyDesk, or Splashtop Enterprise which embed Meterpreter-like functionality for deep system diagnostics and script execution. When a Level 2 engineer initiates a “Deep Scan” or “Remote Script Execution” on a user workstation, the tool’s background service may generate network traffic patterns matching the rule’s IOCs (e.g., specific HTTP headers or certificate chains associated with Meterpreter C2).
  • Filter/Exclusion: Exclude alerts where the parent process is identified as the remote support executable (e.g., TeamViewer_Service.exe, AnyDeskService.exe) and the destination IP belongs to the internal IT Support VLAN subnet.

• Automated Compliance & Patching Scheduled Jobs

  • Scenario: Organizations running automated compliance frameworks using tools like Ansible, Chef, or Microsoft SCCM (Configuration Manager)