Suspicious TCP Tunnel Via PowerShell Script

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•14

Detects PowerShell scripts that create TCP listeners and accept client connections, which is indicative of tunneling activity. The rule specifically looks for the use of '[System.Net.HttpWebRequest]', 'System.Net.Sockets.TcpListener', and 'AcceptTcpClient' within the script block text.