PowerShell Get-NetTCPConnection Execution

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•14

This rule detects the execution of the PowerShell cmdlet 'Get-NetTCPConnection', which adversaries may use to discover network connections on a compromised system. This activity is often part of the discovery phase in an attack chain, where an attacker gathers information about the network environment.