Meterpreter

Overview

Backdoor:Win32/Meterpreter is the flagship, highly advanced, dynamically extensible payload of the open-source Metasploit Framework. It provides attackers (and penetration testers) with an incredibly powerful, entirely memory-resident interactive shell for post-exploitation activities.

Understanding Meterpreter
To the end-user, Meterpreter is completely invisible. For incident responders, detecting Meterpreter means an attacker has achieved a successful exploit and has full, interactive control over the endpoint. Unlike traditional command shells (`cmd.exe`), Meterpreter is designed to be stealthy. It does not spawn a new process; instead, it injects itself directly into the memory space of a compromised process using Reflective DLL Injection. It leaves no footprint on the hard drive.

Execution and Evasion Strategies
Meterpreter is typically delivered as the payload of a successful exploit (e.g., a buffer overflow, a malicious Office macro, or via lateral movement using PsExec). Once the initial stager executes, it connects back to the attacker's Metasploit listener and pulls the full Meterpreter DLL directly into RAM. Because it resides entirely in memory and uses encrypted communications (TLS/SSL), it easily bypasses legacy file-scanning antivirus. Once active, the attacker can dynamically load scripts ('meterpreter scripts' or post-modules) over the network to dump hashes (Mimikatz), pivot to other subnets, capture keystrokes, or manipulate the file system—all without writing a single file to disk.

Indicators of Compromise & Impact
The impact is total, undetectable endpoint compromise. EDR platforms are essential for detecting Meterpreter; they look for behavioral anomalies, such as `svchost.exe` or `notepad.exe` unexpectedly opening an outbound network socket or allocating suspicious memory regions (`VirtualAllocEx` with `PAGE_EXECUTE_READWRITE`). Network logs will show sustained, encrypted beaconing traffic to the attacker's C2 server.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1003.001: Monitor for LSASS memory dumping or registry SAM extraction. Enable Credential Guard on Windows systems.
• T1056.001: Implement Endpoint Detection and Response (EDR) to monitor for suspicious API calls related to keystroke interception. Enforce Multi-Factor Authentication (MFA) to render stolen passwords useless.
• T1071.001: Implement web filtering and SSL/TLS inspection to detect malicious command and control (C2) traffic hiding in HTTP/HTTPS.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_METERPRETER {
    meta:
        description = "Detects Meterpreter (backdoor)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "meterpreter" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Meterpreter Activity
id: 2b0ea882cf9c918a9610d71354fe5166
status: experimental
description: Detects generic indicators of the meterpreter malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*meterpreter*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Isolate the endpoint immediately to sever the attacker's live, interactive Meterpreter session and halt lateral movement.
2. Do NOT reboot the machine. Capture a live memory image (RAM dump) immediately; because Meterpreter is entirely memory-resident, a reboot destroys all evidence of the payload.
3. Utilize EDR or memory forensics (Volatility) to identify the specific process that was hollowed or injected to host the Meterpreter session.
4. Assume total endpoint compromise; perform a clean OS rebuild and force password resets for all accounts, as credential dumping is a standard post-exploitation step.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not rely on standard antivirus scans to find the malware; Meterpreter never touches the hard drive and exists only in RAM.
2. Avoid leaving the machine connected to the network while investigating; the attacker has a live shell and can actively disrupt your response.

References & External Analysis

• Search "meterpreter" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: backdoor)

Explore other malware families in the same category:

• Younglotus
• Houndhack
• Hacdef
• Hawkeyekeylogger
• Orcusrot

Machine-readable

Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/meterpreter.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.