PowerShell Test-NetConnection internal port sweep logging to wserv.log

Arnold Chan@slaz

•updated 19 days ago•0•0•1

Detects PowerShell execution performing port checks across multiple internal hosts using Test-NetConnection in a looping construct with output redirected to a log file, indicative of post-compromise reconnaissance (such as LONEPAGE scanning).