Potential PowerShell Reverse Shell Connection via TcpClient

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•24

Detects the usage of the ".Net.Sockets.TCPClient" class within PowerShell, which is commonly abused to establish remote connections and reverse shells. This technique is notably used by tools like Nishang's "Invoke-PowerShellTcpOneLine" and other malicious scripts to create outbound network connections for command and control or data exfiltration.