Metasploit for Defenders Guide

Metasploit is the exploitation framework most security teams already have, yet it is often run without written scope, from a laptop holding harvested credentials, by people who have never checked whether the SOC can see it. Used well, it proves which vulnerabilities are really exploitable, tests detections against realistic behaviour and gives vulnerability management hard evidence. Used carelessly, it crashes production services, leaves payloads behind and creates a database of your own credentials. Attackers also use it, so defenders need to recognise it. This guide covers what the framework is, how defenders use it safely, how to operate its database, RPC, web service and MCP server securely, and how to detect unauthorised use. It is for security testers, vulnerability managers, SOC teams and the leaders who approve testing. It is defensive: no exploit commands or attack procedures.

This is an independent guide from NHI Mgmt Group, based on Metasploit's public documentation as of November 2026. It is not sponsored or reviewed by Rapid7. Product features change, so confirm settings against the current documentation.

Key takeaways

Use the safety metadata. Every new Metasploit module must declare its Stability, Reliability and SideEffects, and exploit modules carry a reliability rank, so testers can choose crash-safe, low-artefact modules for production.
Check before you exploit. Many modules have a check method that reports Safe, Detected, Appears or Vulnerable, which validates exposure without opening a session.
The framework is a credential store. Its database keeps every credential and piece of loot a test collects, and its RPC, web service and MCP interfaces are authenticated with passwords and tokens that must be protected like any privileged secret.
AI access needs a gate. The Metasploit MCP server keeps module execution and session interaction disabled unless an operator enables dangerous actions, and that switch belongs under change control.
Detect behaviour, not the brand. ATT&CK records Metasploit use by groups including FIN6, Turla, Magic Hound and Wizard Spider; payloads change easily, so durable detections target injection, service creation, beaconing and credential access.

What Metasploit is

The Metasploit Framework is an open source project led by Rapid7 and released under a BSD-style licence (BSD 3-clause, with third-party components under their own licences). It is a modular platform: exploits, payloads and supporting tools are separate modules that can be combined. Meterpreter, its advanced payload, has been part of the framework since 2004 and is developed in the separate metasploit-payloads repository. Penetration testing distributions such as Kali Linux ship it preinstalled.

Module type	What it does (per the documentation)	Defender relevance
Auxiliary	Scanning, gathering, administration, analysis, server support and denial of service, without exploiting a target	Safest starting point for validation; some modules can still lock accounts or crash services
Exploit	Leverages a vulnerability to execute arbitrary code (the payload)	Proves exploitability; needs the strictest scope and change control
Payload	The code that runs after exploitation, usually creating a session; can also be generated standalone	Creates artefacts that must be tracked and removed after the test
Post	Actions after access, such as gathering credentials or system data	Tests what a foothold exposes, including cached credentials
Encoder, Nop, Evasion	Transform payload bytes, pad exploits, or generate payloads that aim to evade antivirus	Evasion modules test endpoint protection, but only under explicit approval

See the Open Source Penetration Testing Tools Landscape Guide for where Metasploit sits among other tools.

Defender use cases

Exploitability validation: confirm whether a scanner finding is actually exploitable in your configuration, so remediation effort goes to real exposure. This gives vulnerability prioritisation evidence beyond a CVSS score. See the Vulnerability Prioritisation Guide.
Patch and mitigation verification: re-run the same check after a fix or a compensating control to show it worked.
Detection engineering and purple teaming: generate realistic exploitation, session and post-exploitation telemetry so the SOC can confirm alerts fire. See the Purple Teaming Guide.
Credential exposure testing: authorised login scanner modules show where default or reused credentials still work on services.
Training: analysts learn what real post-exploitation looks like in their own tools.

Testing safely: the framework's own safety controls

Metasploit documents several signals that help testers avoid harm. Make choosing modules by these signals part of your rules of engagement.

Check codes

Check code	Meaning (per the documentation)	How to treat it
Safe	The check did not trigger the vulnerability or did not detect the service	Evidence of non-exposure only for that check; not proof of safety
Detected	The service is running, but vulnerability could not be determined	Investigate by version and configuration
Appears	Vulnerable based on passive information such as version or banner	Treat as likely; prioritise patching, with the banner caveat
Vulnerable	The check obtained hard evidence by actually exercising the bug	Confirmed exposure; note that this check is itself intrusive
Unknown, Unsupported	Not enough information, or no check available	Fall back to scanner evidence or a controlled exploit in a test window

Rankings and module notes

Signal	Values	Use in production testing
Exploit rank	Excellent (never crashes the service), Great, Good, Normal, Average, Low, Manual	Prefer Excellent or Great; Manual means unstable or effectively a denial of service
Stability	CRASH_SAFE, CRASH_SERVICE_RESTARTS, CRASH_SERVICE_DOWN, CRASH_OS_RESTARTS, CRASH_OS_DOWN, SERVICE_RESOURCE_LOSS, OS_RESOURCE_LOSS	Only CRASH_SAFE without a maintenance window
Side effects	ARTIFACTS_ON_DISK, CONFIG_CHANGES, IOC_IN_LOGS, ACCOUNT_LOCKOUTS, ACCOUNT_LOGOUT, SCREEN_EFFECTS and others	Plan cleanup for artefacts and config changes; warn the help desk about lockouts
Reliability	FIRST_ATTEMPT_FAIL, REPEATABLE_SESSION, UNRELIABLE_SESSION, EVENT_DEPENDENT	Set expectations; event-dependent modules may fire later, outside the window

Production rules worth adopting: run checks before exploits, use only crash-safe modules outside agreed windows, record every module run with its target, and remove every artefact a module declares. NIST SP 800-115 describes the wider discipline of planning and running technical security tests. See the Red Team Rules of Engagement Template and the Penetration Test Scoping Checklist.

Operating Metasploit securely

A Metasploit installation used for internal testing becomes a sensitive system. Treat it as a privileged asset with its own controls.

Component	What it holds or exposes	Secure operation
Database (PostgreSQL, managed by msfdb)	Hosts, services, vulnerabilities, credentials captured by modules ("creds") and other returned data ("loot")	Encrypt the host disk, restrict access, export only what the report needs, purge at engagement close
MessagePack RPC (msfrpcd)	Full remote control of the framework; default port 55553, SSL on by default, username and password authentication	Bind to localhost or a management network, use strong unique credentials, never expose to the internet
Web service (REST API)	Data service with API token authentication; SSL on by default with a generated certificate whose common name will not match your host	Supply your own certificate and enable verification as the documentation advises; rotate API tokens; treat tokens as secrets
MCP server (msfmcpd)	Gives AI applications 16 tools; read-only tools always on, dangerous tools (module execution, checks, session interaction) off by default; HTTP transport uses a bearer token	Keep dangerous actions off unless approved, never disable HTTP authentication, set a persistent strong token, log every tool call
Payload handlers	Listeners that accept sessions from payloads	Use Payload UUID tracking so only known payloads connect, and certificate pinning ("paranoid mode") so others cannot hijack sessions

The documentation describes Payload UUIDs as a way to identify each generated payload and drop connections that do not match known UUIDs, which also gives testers a clean record of which payload ran where. That record is what you need for cleanup and for answering the SOC's question "is this you?"

Where identity fits

Metasploit touches identity in three ways. First, its database accumulates credentials harvested during a test, including service account passwords and hashes, so the testing system can hold more privileged credentials than any production server. Second, its own interfaces are machine identities: the RPC password, web service API tokens and MCP bearer token are non-human credentials that grant full control of an exploitation platform, and they deserve a vault, rotation and an owner. Third, the MCP server lets an AI agent drive the framework, which makes the agent's identity and permissions part of your testing controls. Scope the agent to read-only tools by default and record who enabled dangerous actions and when. See the Local MCP Server Security Guide, the MCP Server Security Checklist and the AI-Assisted and Autonomous Penetration Testing Guide.

Detecting unauthorised Metasploit use

Metasploit is used outside authorised testing. ATT&CK v20 records it in the activity of FIN6, Turla, Magic Hound, Wizard Spider, CopyKittens and Threat Group-3390. The joint advisory AA24-249A on GRU Unit 29155 lists Metasploit alongside Impacket, CrackMapExec and BloodHound, and CISA's ALPHV Blackcat advisory (AA23-353A) also names it among affiliate tools. See the FIN6 Threat Actor Profile Guide and the ALPHV BlackCat Threat Actor Profile.

Behaviour	ATT&CK technique	Telemetry	Notes
Exploit against an internet-facing or internal service	T1190, T1210	WAF and IDS alerts, application crash logs, unexpected child processes of server software	Crashes and restarts of services are a signal in their own right
In-memory payload loading	T1620 Reflective Code Loading, T1055.001 DLL Injection	EDR memory alerts, Sysmon 8 and 10, unbacked executable memory	Meterpreter is designed to run from memory
Remote service execution over SMB	T1569.002, T1021.002	System 7045 and Security 4697 with random service names, 5145 on ADMIN$	The same pattern as other PsExec-style tools
Command and control over HTTP or HTTPS	T1071.001	Proxy logs with short or long base64url-style first path segments, periodic requests, unusual TLS certificates	Handlers can use any port; the documentation's examples use 4444 for listeners
Non-standard ports	T1571	Firewall and flow logs for outbound connections to rare ports from servers	Egress filtering turns this into a block
Token theft and credential gathering	T1134.001, T1003.002	4624 logon type 9, LSASS access alerts, SAM hive access	See the credential dumping guide

Signatures for default Metasploit payloads are common in endpoint products, which is why attackers change them and why detection should rest on behaviour. A default payload firing in your estate still deserves attention: it is either a test you did not register or an intruder using off-the-shelf tooling. See the EDR Evasion and Defence Guide, the Beaconing and C2 Detection Guide and the Credential Dumping Guide.

Implementation: a phased approach

Set the policy. Define who may run exploitation tools, where, against what, and how authorisation is recorded. See the Penetration Testing Policy Template.
Build a testing host. Dedicated, patched, disk-encrypted, not used for email or browsing, with the database, RPC, web service and MCP server bound to localhost or a management network and their credentials in a vault.
Register and notify. Before each engagement, record source addresses, payload UUIDs, handler domains and windows in a register the SOC can see.
Validate in a lab first. Run the planned modules against a representative lab system to see their real effect, then use only crash-safe modules in production outside maintenance windows.
Test detection as you go. For each technique exercised, record whether the SOC alerted, how fast, and with what context.
Clean up and close. Remove artefacts the modules declare, revoke test accounts, export the evidence the report needs, purge the database and rotate the framework's own credentials.

If a module causes unexpected impact, stop, restore the service through normal incident processes, and record the module and its declared stability so the mistake is not repeated.

Decision guidance

Metasploit or a breach and attack simulation platform? Metasploit gives depth and real exploitation for specific findings; BAS platforms give scheduled, repeatable and broad control validation with less skill required. Many teams use BAS for coverage and Metasploit for proof. See the Breach and Attack Simulation (BAS) Guide.
In-house or provider? Small organisations usually get better value from a penetration testing provider; insist on module logs, artefact lists and cleanup evidence in the report. Larger teams with a vulnerability management function benefit from in-house exploitability checks.
AI-driven use? Start with read-only MCP tools to help analysts query results. Enable execution only in a lab or with a human approving each action.

Metrics that show it is working

Validated findings: percentage of critical scanner findings with an exploitability check result recorded.
Detection rate: share of exercised techniques that produced a SOC alert within 15 minutes.
Unplanned impact: number of service disruptions caused by testing (target zero).
Cleanup completeness: engagements closed with all declared artefacts removed and the database purged (target 100%).
Unregistered activity: Metasploit-like detections with no matching register entry, each investigated to closure.

Common failure patterns

Exploiting before checking. Running an exploit with an Average or Manual rank against production to "see if it works" causes outages that damage the testing programme's credibility.
A testing laptop full of credentials. Harvested hashes and passwords stay in the database long after the engagement, on a machine that travels.
Exposed management interfaces. RPC or web service listening on all interfaces with weak or default credentials hands an attacker a ready-made exploitation platform.
Disabling MCP authentication for convenience. The documentation allows it and advises against it; an unauthenticated HTTP MCP endpoint lets any local or network client drive the framework.
Leftover payloads and accounts. Artefacts not removed after a test are indistinguishable from an intrusion later, and test accounts become real backdoors.
Whitelisting the testers. Suppressing alerts from the test range means the organisation never learns whether its detections work.

Framework mapping

Framework	Reference	Relevance
NIST SP 800-53 Rev. 5	CA-8 Penetration Testing, CA-2 Control Assessments, RA-5 Vulnerability Monitoring and Scanning, SI-4 System Monitoring, SI-3 Malicious Code Protection, CM-7 Least Functionality	Testing, assessment and validation, plus detection and hardening of the test host
NIST CSF 2.0	ID.RA-01, ID.IM-02, DE.CM-01, DE.CM-09	Vulnerability validation, improvement from tests, network and platform monitoring
CIS Controls v8.1	7 Continuous Vulnerability Management, 18 Penetration Testing	Exploitability evidence and testing programme
MITRE ATT&CK v20	T1588.002 Tool; T1190, T1210, T1620, T1055.001, T1569.002, T1071.001, T1571	Adversary acquisition of tools and the behaviours to detect
MITRE D3FEND	D3-PA Process Analysis, D3-CAA Connection Attempt Analysis, D3-NTCD Network Traffic Community Deviation, D3-EAL Executable Allowlisting	Detection of payload behaviour and control of tooling on endpoints

Practitioner checklist

Require written scope and a test register entry, shared with the SOC, before any Metasploit use.
Run check methods before exploits, and use only crash-safe modules in production outside maintenance windows.
Run the framework from a dedicated, encrypted host with the database, RPC, web service and MCP server bound locally.
Store RPC passwords, API tokens and the MCP bearer token in a vault and rotate them after each engagement.
Keep MCP dangerous actions disabled unless a named person approves a time-boxed exception.
Use Payload UUID tracking and certificate pinning so only your payloads connect and every session is attributable.
Remove declared artefacts, revoke test accounts and purge creds and loot at engagement close.
Track detection rate for exercised techniques and feed misses into detection engineering.

Metasploit for Defenders Guide: Safe Validation, Secure Operation and Detection