Network Connection Initiated By PowerShell Process
Detects a network connection that was initiated from a PowerShell process. Malicious PowerShell scripts often download additional payloads or communicate back to command and control channels via uncommon ports or IPs. This rule can be used as a basis for hunting for anomalies.
Sigma
