PowerShell Get-NetTCPConnection Module Use for Network Connection Discovery (Windows)

Detects PowerShell use of Get-NetTCPConnection to enumerate TCP network connections for discovery.

FreeUnreviewedSigmalowv1

powershell-get-nettcpconnection-module-use-for-network-connection-discovery-wind-aff815cc

title: PowerShell Get-NetTCPConnection Module Use for Network Connection Discovery (Windows)
id: 45a1e736-d3e1-4a17-9188-d45dc6411255
status: test
description: This rule flags PowerShell activity that includes the string "Get-NetTCPConnection", indicating a command used to enumerate TCP network connections. Attackers may use this capability to understand which local or remote systems are communicating with the host during discovery. It relies on PowerShell telemetry where command context information contains the function/module name.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1049/T1049.md#atomic-test-2---system-network-connections-discovery-with-powershell
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_module/posh_pm_susp_get_nettcpconnection.yml
author: frack113, Huntrule Team
date: 2021-12-10
modified: 2022-12-02
tags:
  - attack.discovery
  - attack.t1049
logsource:
  product: windows
  category: ps_module
  definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b
detection:
  selection:
    ContextInfo|contains: Get-NetTCPConnection
  condition: selection
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: aff815cc-e400-4bf0-a47a-5d8a2407d4e1
    type: derived

What it detects

This rule flags PowerShell activity that includes the string "Get-NetTCPConnection", indicating a command used to enumerate TCP network connections. Attackers may use this capability to understand which local or remote systems are communicating with the host during discovery. It relies on PowerShell telemetry where command context information contains the function/module name.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.