huntrule

PowerShell Script TCP Tunnel Indicators on Windows via .NET Socket APIs

Flags PowerShell scripts referencing TcpListener/AcceptTcpClient and HttpWebRequest as potential TCP tunneling behavior.

FreeUnreviewedSigmamediumv1
title: PowerShell Script TCP Tunnel Indicators on Windows via .NET Socket APIs
id: 2a1490e6-9a66-4f7e-9773-331f9abffc91
status: test
description: This rule identifies PowerShell script content that references .NET networking primitives commonly used to implement TCP tunneling, including HttpWebRequest, TcpListener, and AcceptTcpClient. Attackers may use similar script-built socket listeners and connections to proxy traffic or maintain covert command-and-control paths. The detection relies on PowerShell Script Block Logging telemetry containing the matched script text.
references:
  - https://github.com/Arno0x/PowerShellScripts/blob/a6b7d5490fbf0b20f91195838f3a11156724b4f7/proxyTunnel.ps1
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_proxy_scripts.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-08
tags:
  - attack.command-and-control
  - attack.t1090
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains|all:
      - "[System.Net.HttpWebRequest]"
      - System.Net.Sockets.TcpListener
      - AcceptTcpClient
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: bd33d2aa-497e-4651-9893-5c5364646595
    type: derived

What it detects

This rule identifies PowerShell script content that references .NET networking primitives commonly used to implement TCP tunneling, including HttpWebRequest, TcpListener, and AcceptTcpClient. Attackers may use similar script-built socket listeners and connections to proxy traffic or maintain covert command-and-control paths. The detection relies on PowerShell Script Block Logging telemetry containing the matched script text.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.