PowerShell Reverse Shell via TCPClient
Detects PowerShell establishing a reverse shell using the .NET Net.Sockets.TCPClient class and GetStream method. This is a common technique used by adversaries to create an interactive shell for remote control.
Microsoft Sentinel (KQL)
