PowerShell TCP Tunnel Indicators: HttpWebRequest and TcpListener Usage (Windows
Flags PowerShell scripts referencing TcpListener/AcceptTcpClient and HttpWebRequest as potential TCP tunneling behavior.
- Product
- windows
- Category
- ps_script
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-07-08
- Updated
- 2026-07-31
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags PowerShell script block text containing all of: System.Net.HttpWebRequest, System.Net.Sockets.TcpListener, and AcceptTcpClient. The combination is consistent with scripts that establish network communications and act as a TCP listener, which can be used for tunneling or proxy-like behavior. It relies on PowerShell Script Block Logging telemetry that captures the executed script content.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "PowerShell TCP Tunnel Indicators: HttpWebRequest and TcpListener Usage (Windows"
id: 2a1490e6-9a66-4f7e-9773-331f9abffc91
status: test
description: "This rule flags PowerShell script block text containing all of: System.Net.HttpWebRequest, System.Net.Sockets.TcpListener, and AcceptTcpClient. The combination is consistent with scripts that establish network communications and act as a TCP listener, which can be used for tunneling or proxy-like behavior. It relies on PowerShell Script Block Logging telemetry that captures the executed script content."
references:
- https://github.com/Arno0x/PowerShellScripts/blob/a6b7d5490fbf0b20f91195838f3a11156724b4f7/proxyTunnel.ps1
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_proxy_scripts.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-08
tags:
- attack.command-and-control
- attack.t1090
logsource:
product: windows
category: ps_script
definition: "Requirements: Script Block Logging must be enabled"
detection:
selection:
ScriptBlockText|contains|all:
- "[System.Net.HttpWebRequest]"
- System.Net.Sockets.TcpListener
- AcceptTcpClient
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: bd33d2aa-497e-4651-9893-5c5364646595
type: derived