Windows PowerShell Testing for Uncommon Network Ports via Test-NetConnection

Detects PowerShell scripts using Test-NetConnection to reach a target on non-443/80 ports.

FreeUnreviewedSigmamediumv1

windows-powershell-testing-for-uncommon-network-ports-via-test-netconnection-adf876b3

title: Windows PowerShell Testing for Uncommon Network Ports via Test-NetConnection
id: c5a80675-e0a7-429d-b6bf-d479899e40b9
status: test
description: This rule flags PowerShell script blocks that call Test-NetConnection for a specified remote host and port, where the script does not include common web ports (443, 80). Attackers often probe or validate command-and-control connectivity using non-standard port/protocol combinations that may bypass typical allowlists and monitoring. The detection relies on PowerShell Script Block Logging and matches specific parameter usage patterns in the recorded script text.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1571/T1571.md#atomic-test-1---testing-usage-of-uncommonly-used-port-with-powershell
  - https://learn.microsoft.com/en-us/powershell/module/nettcpip/test-netconnection?view=windowsserver2022-ps
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_test_netconnection.yml
author: frack113, Huntrule Team
date: 2022-01-23
tags:
  - attack.command-and-control
  - attack.t1571
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains|all:
      - Test-NetConnection
      - "-ComputerName "
      - "-port "
  filter:
    ScriptBlockText|contains:
      - " 443 "
      - " 80 "
  condition: selection and not filter
falsepositives:
  - Legitimate administrative script
level: medium
license: DRL-1.1
related:
  - id: adf876b3-f1f8-4aa9-a4e4-a64106feec06
    type: derived

What it detects

This rule flags PowerShell script blocks that call Test-NetConnection for a specified remote host and port, where the script does not include common web ports (443, 80). Attackers often probe or validate command-and-control connectivity using non-standard port/protocol combinations that may bypass typical allowlists and monitoring. The detection relies on PowerShell Script Block Logging and matches specific parameter usage patterns in the recorded script text.

Known false positives

Legitimate administrative script

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.