Meterpreter is a post-exploitation payload framework associated with Metasploit. It provides an interactive session that can let an operator run commands and perform actions on a compromised system. Implementations may operate largely in memory, and attackers can modify or imitate Meterpreter rather than use an unaltered, standard payload.
In an attack, a Meterpreter-style payload may be delivered through a loader or a malicious DLL loaded by a legitimate application. This can make activity harder to spot with file-only scanning. Defenders should monitor process behavior, unexpected DLL loads, network connections, and suspicious executable memory, and should treat the name “Meterpreter-based” as a description—not proof that a standard Metasploit binary was used.