PowerShell TCP Tunnel Indicators: HttpWebRequest and TcpListener Usage (Windows

Flags PowerShell scripts referencing TcpListener/AcceptTcpClient and HttpWebRequest as potential TCP tunneling behavior.

FreeReviewedSigma · Medium · v2

Product: windows
Category: ps_script
Author: Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2022-07-08
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1090Proxy
Exfiltration
Impact

What it detects

This rule flags PowerShell script block text containing all of: System.Net.HttpWebRequest, System.Net.Sockets.TcpListener, and AcceptTcpClient. The combination is consistent with scripts that establish network communications and act as a TCP listener, which can be used for tunneling or proxy-like behavior. It relies on PowerShell Script Block Logging telemetry that captures the executed script content.

Reporting behind it

Related detections9 linkedT1090 — drag to rearrange

Suspicious Flax Typhoon System Utility Masquerade Outside System32 via Renamed VPN Client (via process_creation)

Possible Credential Stuffing Blocked by Conditional Access in Microsoft 365

Possible ReverseSocks5 Tunneling Tool Execution on Linux (via process_creation)

Malicious GhostSocks Loader Execution with johnpidar Argument via process_creation

Malicious Chisel Reverse SOCKS Proxy Execution (via process_creation)

Malicious QEMU Covert Network Tunnel via User-Mode netdev Socket (via process_creation)

Malicious Tunneling Tool Execution on Linux Host (via process_creation)

Suspicious Chisel Reverse Tunnel Execution by UAT-9686

Suspicious macOS Trojan-Proxy LaunchAgent GoogleHelperUpdater Persistence (via file_event)

PowerShell TCP Tunnel Indicators: HttpWebRequest and TcpListener Usage (Windows

Pivot detection · T1090 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

powershell-script-tcp-tunnel-indicators-on-windows-via-net-socket-apis-bd33d2aa

title: "PowerShell TCP Tunnel Indicators: HttpWebRequest and TcpListener Usage (Windows"
id: 2a1490e6-9a66-4f7e-9773-331f9abffc91
status: test
description: "This rule flags PowerShell script block text containing all of: System.Net.HttpWebRequest, System.Net.Sockets.TcpListener, and AcceptTcpClient. The combination is consistent with scripts that establish network communications and act as a TCP listener, which can be used for tunneling or proxy-like behavior. It relies on PowerShell Script Block Logging telemetry that captures the executed script content."
references:
  - https://github.com/Arno0x/PowerShellScripts/blob/a6b7d5490fbf0b20f91195838f3a11156724b4f7/proxyTunnel.ps1
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_proxy_scripts.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-08
tags:
  - attack.command-and-control
  - attack.t1090
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains|all:
      - "[System.Net.HttpWebRequest]"
      - System.Net.Sockets.TcpListener
      - AcceptTcpClient
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: bd33d2aa-497e-4651-9893-5c5364646595
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL