Hunt package for 4 IOCs associated with Meterpreter
Malware Family: Meterpreter Total IOCs: 4 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 168[.]245[.]203[.]223:3790 | botnet_cc | 2026-03-19 | 100% |
| ip:port | 168[.]245[.]203[.]114:3790 | botnet_cc | 2026-03-19 | 100% |
| ip:port | 199[.]101[.]111[.]21:3790 | botnet_cc | 2026-03-19 | 100% |
| ip:port | 199[.]101[.]111[.]75:3790 | botnet_cc | 2026-03-19 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Meterpreter
let malicious_ips = dynamic(["168.245.203.223", "168.245.203.114", "199.101.111.21", "199.101.111.75"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["168.245.203.223", "168.245.203.114", "199.101.111.21", "199.101.111.75"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |