PowerShell Test-NetConnection internal port sweep logging to wserv.log
Detects PowerShell execution performing port checks across multiple internal hosts using Test-NetConnection in a looping construct with output redirected to a log file, indicative of post-compromise reconnaissance (such as LONEPAGE scanning).
Microsoft Sentinel (KQL)
