{
  "family": "meterpreter",
  "sample_count": 78,
  "category": "backdoor",
  "description": "Backdoor:Win32/Meterpreter is the flagship, highly advanced, dynamically extensible payload of the open-source Metasploit Framework. It provides attackers (and penetration testers) with an incredibly powerful, entirely memory-resident interactive shell for post-exploitation activities.<br><br><b>Understanding Meterpreter</b><br>To the end-user, Meterpreter is completely invisible. For incident responders, detecting Meterpreter means an attacker has achieved a successful exploit and has full, interactive control over the endpoint. Unlike traditional command shells (`cmd.exe`), Meterpreter is designed to be stealthy. It does not spawn a new process; instead, it injects itself directly into the memory space of a compromised process using Reflective DLL Injection. It leaves no footprint on the hard drive.<br><br><b>Execution and Evasion Strategies</b><br>Meterpreter is typically delivered as the payload of a successful exploit (e.g., a buffer overflow, a malicious Office macro, or via lateral movement using PsExec). Once the initial stager executes, it connects back to the attacker's Metasploit listener and pulls the full Meterpreter DLL directly into RAM. Because it resides entirely in memory and uses encrypted communications (TLS/SSL), it easily bypasses legacy file-scanning antivirus. Once active, the attacker can dynamically load scripts ('meterpreter scripts' or post-modules) over the network to dump hashes (Mimikatz), pivot to other subnets, capture keystrokes, or manipulate the file system—all without writing a single file to disk.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total, undetectable endpoint compromise. EDR platforms are essential for detecting Meterpreter; they look for behavioral anomalies, such as `svchost.exe` or `notepad.exe` unexpectedly opening an outbound network socket or allocating suspicious memory regions (`VirtualAllocEx` with `PAGE_EXECUTE_READWRITE`). Network logs will show sustained, encrypted beaconing traffic to the attacker's C2 server.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1620",
    "T1003.001",
    "T1055.001",
    "T1071.001",
    "T1056.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1620",
      "name": "Reflective Code Loading",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1055.001",
      "name": "Process Injection: Dynamic-link Library Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
    },
    {
      "id": "T1003.001",
      "name": "OS Credential Dumping: LSASS Memory",
      "tactic": "Credential Access"
    },
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Collection"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately to sever the attacker's live, interactive Meterpreter session and halt lateral movement.",
    "Do NOT reboot the machine. Capture a live memory image (RAM dump) immediately; because Meterpreter is entirely memory-resident, a reboot destroys all evidence of the payload.",
    "Utilize EDR or memory forensics (Volatility) to identify the specific process that was hollowed or injected to host the Meterpreter session.",
    "Assume total endpoint compromise; perform a clean OS rebuild and force password resets for all accounts, as credential dumping is a standard post-exploitation step."
  ],
  "what_to_avoid": [
    "Do not rely on standard antivirus scans to find the malware; Meterpreter never touches the hard drive and exists only in RAM.",
    "Avoid leaving the machine connected to the network while investigating; the attacker has a live shell and can actively disrupt your response."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}