This hypothesis posits that adversaries are actively deploying Meterpreter implants to establish persistent command-and-control channels and execute post-exploitation tasks within the Azure environment. The SOC team should proactively hunt for these specific IOCs in Azure Sentinel because early detection of this widely used post-exploitation tool allows for rapid containment before attackers can expand their lateral movement or exfiltrate sensitive data.
Malware Family: Meterpreter Total IOCs: 4 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 103[.]177[.]46[.]36:3790 | botnet_cc | 2026-07-11 | 50% |
| ip:port | 168[.]245[.]203[.]188:3790 | botnet_cc | 2026-07-11 | 50% |
| ip:port | 168[.]245[.]203[.]104:3790 | botnet_cc | 2026-07-11 | 50% |
| ip:port | 168[.]245[.]203[.]176:3790 | botnet_cc | 2026-07-11 | 50% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Meterpreter
let malicious_ips = dynamic(["103.177.46.36", "168.245.203.188", "168.245.203.176", "168.245.203.104"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["103.177.46.36", "168.245.203.188", "168.245.203.176", "168.245.203.104"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Here are four specific false positive scenarios for the ThreatFox: Meterpreter IOCs detection rule, tailored for an enterprise environment where legitimate administrative and development activities often mimic C2 beaconing behavior.
Endpoint Management Agent Updates (e.g., Microsoft Endpoint Configuration Manager / SCCM)
ccmexec.exe) frequently initiates background tasks to download software updates or deploy new configurations. These processes spawn child processes that establish persistent HTTPS connections to the internal Software Update Point server, generating network traffic patterns (specifically User-Agent strings and TLS handshakes) that closely resemble Meterpreter’s default beaconing behavior.ccmexec.exe or ccmsetup.exe where the destination IP belongs to the internal SCCM infrastructure subnet (e.g., 10.x.x.x) and the traffic port is restricted to 443.Automated PowerShell Patching Scripts
powershell.exe or pwsh.exe) to check for missing patches, query Active Directory attributes, or push configuration changes. These scripts frequently utilize the .NET framework to make REST API calls to internal management consoles, triggering IOCs related to encoded HTTP requests and specific certificate thumbprints associated with Meterpreter’s communication channels.-Command, Invoke-WebRequest, or Get-HotFix and is initiated by a known service account (e.g., DOMAIN\PatchingSvc) running on a recurring schedule defined in Task Scheduler.DevOps CI/CD Pipeline Agents