PowerShell Test-NetConnection to Uncommonly Used Port

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•19

This rule detects the usage of the PowerShell cmdlet `Test-NetConnection` to probe network connectivity to a specified computer name and port, specifically looking for connections to ports other than the commonly used 80 or 443. This behavior can indicate an adversary attempting to establish or test communication channels over non-standard ports, potentially to bypass network defenses or obscure command and control activities.