PowerShell loopback listener with self-authentication for NTLM capture
Detects PowerShell processes combining local loopback listener terms (such as HttpListener or TcpListener) and authentication or web request cmdlets referencing 127.0.0.1 or localhost, correlated with local network loopback connections.
Microsoft Sentinel (KQL)
