PowerShell Get-NetTCPConnection Network Connection Discovery (Windows)

Detects PowerShell use of Get-NetTCPConnection to enumerate TCP network connections for discovery.

FreeReviewedSigma · Low · v2

Product: windows
Category: ps_module
Author: frack113 (SigmaHQ), DRL 1.1
Published: 2021-12-10
Updated: 2026-07-31

ATT&CK techniques

Discovery

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
- T1049System Network Connections Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags PowerShell module usage that contains the string "Get-NetTCPConnection", indicating an attempt to enumerate active TCP network connections from the host or to remote systems. Attackers can use this information for situational awareness, lateral movement planning, or validating network paths. The detection relies on PowerShell command/module context telemetry that captures the executed content containing "Get-NetTCPConnection".

Reporting behind it

Related detections9 linkedT1049 — drag to rearrange

Suspicious Java Process Spawning Reconnaissance Commands via Cleo MFT (via process_creation)

Suspicious Reconnaissance Spawned by Injected SearchProtocolHost via process_creation

Windows Process Creation Signals for Pikabot System Discovery

Windows Net.exe Network Connections Discovery via Use Sessions Query

Windows Process Creation: SharpView.exe with Recon/Domain Discovery Cmdlets

Windows PowerShell: Query TCP connections with Get-NetTCPConnection

Linux System Network Connections Discovery via who, w, last, lsof, or netstat

macOS System Network Connection Discovery via who, w, last, lsof, or netstat

Cisco AAA discovery via show/dir commands

PowerShell Get-NetTCPConnection Network Connection Discovery (Windows)

Pivot detection · T1049 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

powershell-get-nettcpconnection-module-use-for-network-connection-discovery-wind-aff815cc

title: PowerShell Get-NetTCPConnection Network Connection Discovery (Windows)
id: 45a1e736-d3e1-4a17-9188-d45dc6411255
status: test
description: This rule flags PowerShell module usage that contains the string "Get-NetTCPConnection", indicating an attempt to enumerate active TCP network connections from the host or to remote systems. Attackers can use this information for situational awareness, lateral movement planning, or validating network paths. The detection relies on PowerShell command/module context telemetry that captures the executed content containing "Get-NetTCPConnection".
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1049/T1049.md#atomic-test-2---system-network-connections-discovery-with-powershell
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_module/posh_pm_susp_get_nettcpconnection.yml
author: frack113, Huntrule Team
date: 2021-12-10
modified: 2022-12-02
tags:
  - attack.discovery
  - attack.t1049
logsource:
  product: windows
  category: ps_module
  definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b
detection:
  selection:
    ContextInfo|contains: Get-NetTCPConnection
  condition: selection
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: aff815cc-e400-4bf0-a47a-5d8a2407d4e1
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL