{
  "family": "meterpreter",
  "sample_count": 78,
  "category": "hacktool",
  "description": "Meterpreter (cataloged across security vendors and threat intelligence databases under detections including HackTool:Win32/Meterpreter, Trojan:Win32/Meterpreter, and Meterpreter) is an advanced, dynamically extensible post-exploitation payload framework originating from the Metasploit Framework. Operating entirely in-memory via reflective DLL injection, Meterpreter leaves zero disk forensic footprints and avoids standard file-based antivirus signatures. It communicates over encrypted TLS/HTTPS or reverse TCP channels, providing remote penetration testers and unauthorized threat actors with comprehensive interactive control over compromised endpoints. Capabilities include memory dump extraction (Mimikatz integration for LSASS), keystroke logging, token manipulation, network route pivoting, process migration into system binaries (such as explorer.exe or svchost.exe), and executing arbitrary in-memory shellcode without spawning child processes.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "HackTool:Win32/Meterpreter",
    "Trojan:Win32/Meterpreter",
    "Meterpreter",
    "Metasploit:Meterpreter"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Meterpreter?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Meterpreter is an advanced, in-memory post-exploitation payload from the Metasploit Framework used for remote system control."
      }
    },
    {
      "@type": "Question",
      "name": "Why is Meterpreter difficult for traditional antivirus to detect?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It executes purely in-memory using reflective DLL injection, leaving no files on disk for static signature scanners."
      }
    },
    {
      "@type": "Question",
      "name": "What capabilities does Meterpreter offer to an attacker?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Process migration, token impersonation, credential dumping, keystroke logging, webcam/mic capture, and network pivoting."
      }
    },
    {
      "@type": "Question",
      "name": "How does Meterpreter communicate with its command server?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It uses encrypted reverse TCP, HTTP, or HTTPS stagers connecting back to a Metasploit listener."
      }
    },
    {
      "@type": "Question",
      "name": "How do enterprise security teams detect Meterpreter activity?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Through memory inspection (EDR), monitoring cross-process thread creation, and detecting anomalous outbound TLS sessions."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1055.001",
    "T1055.012",
    "T1059.003",
    "T1003.001",
    "T1090",
    "T1056.001",
    "T1113",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1620",
      "name": "Reflective Code Loading",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1055.001",
      "name": "Process Injection: Dynamic-link Library Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
    },
    {
      "id": "T1003.001",
      "name": "OS Credential Dumping: LSASS Memory",
      "tactic": "Credential Access"
    },
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Collection"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately to sever the attacker's live, interactive Meterpreter session and halt lateral movement.",
    "Do NOT reboot the machine. Capture a live memory image (RAM dump) immediately; because Meterpreter is entirely memory-resident, a reboot destroys all evidence of the payload.",
    "Utilize EDR or memory forensics (Volatility) to identify the specific process that was hollowed or injected to host the Meterpreter session.",
    "Assume total endpoint compromise; perform a clean OS rebuild and force password resets for all accounts, as credential dumping is a standard post-exploitation step."
  ],
  "what_to_avoid": [
    "Do not rely on standard antivirus scans to find the malware; Meterpreter never touches the hard drive and exists only in RAM.",
    "Avoid leaving the machine connected to the network while investigating; the attacker has a live shell and can actively disrupt your response."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Penetration Testing & Unauthorized Control",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "persistence",
    "command_and_control",
    "remote_access"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2004,
  "threat_actor": null,
  "delivery_mechanism": [
    "Metasploit Exploit Modules",
    "Reflective DLL Stagers",
    "Phishing Payloads with Embedded Shellcode"
  ],
  "target_platforms": [
    "Windows Server 2022",
    "Windows 11",
    "Windows 10",
    "Linux",
    "macOS"
  ],
  "capabilities": [
    "Reflective DLL Injection",
    "In-Memory Process Migration",
    "LSASS Credential Harvesting (Mimikatz)",
    "Network Route Pivoting",
    "Encrypted Reverse TLS/TCP C2"
  ],
  "technical_analysis": {
    "file_types": [
      "Reflective DLL",
      "Shellcode Stager",
      "Win32 PE Executable"
    ],
    "network_signatures": [
      "Reverse TLS/HTTPS connections with custom SSL certificate parameters",
      "Encrypted TLV (Type-Length-Value) protocol packets over TCP"
    ],
    "evasion_techniques": [
      "100% memory-resident execution leaving no disk artifacts",
      "Process migration into trusted system processes like svchost.exe"
    ],
    "persistence_mechanisms": [
      "Usually paired with scheduled tasks or registry persistence modules"
    ]
  },
  "impact": {
    "confidentiality": "High",
    "integrity": "High",
    "availability": "High",
    "scope": "Total operating system takeover, domain credential compromise, enterprise network pivoting"
  },
  "lineage": {
    "derived_from": [
      "Metasploit Framework"
    ],
    "variants": [
      "Meterpreter x86",
      "Meterpreter x64",
      "Mettle (POSIX)"
    ]
  },
  "iocs": {
    "file_hashes": [
      "b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2",
      "7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b"
    ],
    "delivery": [
      "meterpreter_stager.exe",
      "payload_reverse_tcp.bin"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\WindowsSecurityUpdate"
    ]
  },
  "sources": [
    {
      "name": "Metasploit Unleashed - About Meterpreter",
      "url": "https://www.offsec.com/metasploit-unleashed/about-meterpreter/"
    },
    {
      "name": "Microsoft Defender Security Intelligence - HackTool:Win32/Meterpreter",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=HackTool:Win32/Meterpreter"
    }
  ]
}