PowerShell Get-NetTCPConnection for Network Discovery

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•15

This rule detects the execution of the 'Get-NetTCPConnection' PowerShell cmdlet. This cmdlet is used to retrieve information about TCP connections on a system. Adversaries may use this for system network connections discovery to understand the network environment of a compromised host.