This hypothesis targets the presence of known Meterpreter indicators of compromise, which adversaries frequently deploy to establish persistent command-and-control channels and execute post-exploitation actions. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised endpoints early, preventing attackers from leveraging this versatile payload for privilege escalation, lateral movement, or data exfiltration before they can fully establish a foothold in the environment.
Malware Family: Meterpreter Total IOCs: 2 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 168[.]245[.]203[.]180:3790 | botnet_cc | 2026-09-20 | 50% |
| ip:port | 168[.]245[.]203[.]185:3790 | botnet_cc | 2026-09-20 | 50% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Meterpreter
let malicious_ips = dynamic(["168.245.203.185", "168.245.203.180"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["168.245.203.185", "168.245.203.180"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Automated Patch Management and Configuration Scripts: Enterprise patch management tools (e.g., SCCM, Ansible, or Chef) often execute PowerShell or Bash scripts to apply updates or enforce configurations. If these scripts use standard networking commands like netstat, curl, or wget to verify connectivity or download payloads, they may match the IOCs if the specific hash or command line string coincides with known Meterpreter artifacts.
ccmexec.exe, ansible-playbook, chef-client) or where the command line contains specific patch management keywords (e.g., “patch”, “update”, “config”).Security Tooling and EDR Telemetry: Security products like CrowdStrike Falcon, Carbon Black, or SentinelOne frequently use network listeners or specific socket operations to maintain agent connectivity. If the detection logic includes IOCs based on specific TCP/UDP port bindings or socket creation patterns, these legitimate security agents may trigger the rule.
FalconSensor.exe, cb.exe, sentinelone-agent) or where the process path resides in the vendor’s specific installation directory (e.g., C:\Program Files\CrowdStrike\).CI/CD Pipeline Build Agents: In DevOps environments, build agents (e.g., Jenkins, Azure DevOps, GitHub Actions runners) execute build scripts that may involve compiling code, downloading dependencies, or running unit tests. These processes often open network connections or execute commands that resemble Meterpreter’s post-exploitation behavior, especially if the build scripts use generic network utilities.
jenkins.exe,