PowerShell TCP Tunnel Indicators: HttpWebRequest and TcpListener Usage (Windows

Flags PowerShell scripts referencing TcpListener/AcceptTcpClient and HttpWebRequest as potential TCP tunneling behavior.

FreeReviewedSigma · Medium · v2

Product: windows
Category: ps_script
Author: Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2022-07-08
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1090Proxy
Exfiltration
Impact

What it detects

This rule flags PowerShell script block text containing all of: System.Net.HttpWebRequest, System.Net.Sockets.TcpListener, and AcceptTcpClient. The combination is consistent with scripts that establish network communications and act as a TCP listener, which can be used for tunneling or proxy-like behavior. It relies on PowerShell Script Block Logging telemetry that captures the executed script content.

Reporting behind it

Related detections9 linkedT1090 — drag to rearrange

Malicious Java Backdoor Execution from Public Documents via javaw (via process_creation)

Suspicious Proxyware Installation via accept-tos Flag on Linux

Suspicious DNS Query to Dynamic DNS and Tunneling Providers Abused by RATs

Malicious GenAI Browser Extension C2 and PAC Redirection (via proxy)

Malicious FRP Reverse Proxy Tunnel Identified by Hardcoded Token (via process_creation)

Suspicious SSH Reverse Tunnel Over DNS Port

Suspicious Chisel SOCKS Tunnel Command Line

Suspicious Cloudflare Quick Tunnel Used for Covert Access (via dns_query)

Suspicious SOCKS Proxy Autorun Registry Persistence via Registry Set

PowerShell TCP Tunnel Indicators: HttpWebRequest and TcpListener Usage (Windows

Pivot detection · T1090 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

powershell-script-tcp-tunnel-indicators-on-windows-via-net-socket-apis-bd33d2aa

title: "PowerShell TCP Tunnel Indicators: HttpWebRequest and TcpListener Usage (Windows"
id: 2a1490e6-9a66-4f7e-9773-331f9abffc91
status: test
description: "This rule flags PowerShell script block text containing all of: System.Net.HttpWebRequest, System.Net.Sockets.TcpListener, and AcceptTcpClient. The combination is consistent with scripts that establish network communications and act as a TCP listener, which can be used for tunneling or proxy-like behavior. It relies on PowerShell Script Block Logging telemetry that captures the executed script content."
references:
  - https://github.com/Arno0x/PowerShellScripts/blob/a6b7d5490fbf0b20f91195838f3a11156724b4f7/proxyTunnel.ps1
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_proxy_scripts.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-08
tags:
  - attack.command-and-control
  - attack.t1090
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains|all:
      - "[System.Net.HttpWebRequest]"
      - System.Net.Sockets.TcpListener
      - AcceptTcpClient
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: bd33d2aa-497e-4651-9893-5c5364646595
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL