Windows PowerShell Scripts Testing Uncommon Port Connectivity via Test-NetConnection

Detects PowerShell scripts using Test-NetConnection to reach a target on non-443/80 ports.

FreeReviewedSigma · Medium · v2

Product: windows
Category: ps_script
Author: frack113 (SigmaHQ), DRL 1.1
Published: 2022-01-23
Updated: 2026-07-31

ATT&CK techniques

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1571Non-Standard Port
Exfiltration
Impact

What it detects

This rule flags PowerShell script blocks that call Test-NetConnection with both a ComputerName and a port argument, specifically when the target port is uncommon (not 443 or 80). Using nonstandard ports for application-layer connectivity can help adversaries blend command-and-control traffic or application traffic away from expected defaults. It relies on Script Block Logging telemetry capturing the contents of the PowerShell script block text, including the Test-NetConnection parameters.

Reporting behind it

Related detections7 linkedT1571 — drag to rearrange

Suspicious Outbound Connection To MoonPeak C2 High Ports

Possible Remcos C2 Connection from eilowutil Process

Malicious UNC4841 SSH Backdoor Persistence via Non-Standard Port and AllowUsers Restriction (via process_creation)

Malicious Reverse Shell via socat

Linux network connections to known malware callback ports

Windows Network Connections to Known Malware Callback Ports (Suspicious Destination Ports)

Windows Network Connections to Uncommon Ports (8080, 8888)

Windows PowerShell Scripts Testing Uncommon Port Connectivity via Test-NetConnection

Pivot detection · T1571 · 7 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-powershell-testing-for-uncommon-network-ports-via-test-netconnection-adf876b3

title: Windows PowerShell Scripts Testing Uncommon Port Connectivity via Test-NetConnection
id: c5a80675-e0a7-429d-b6bf-d479899e40b9
status: test
description: This rule flags PowerShell script blocks that call Test-NetConnection with both a ComputerName and a port argument, specifically when the target port is uncommon (not 443 or 80). Using nonstandard ports for application-layer connectivity can help adversaries blend command-and-control traffic or application traffic away from expected defaults. It relies on Script Block Logging telemetry capturing the contents of the PowerShell script block text, including the Test-NetConnection parameters.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1571/T1571.md#atomic-test-1---testing-usage-of-uncommonly-used-port-with-powershell
  - https://learn.microsoft.com/en-us/powershell/module/nettcpip/test-netconnection?view=windowsserver2022-ps
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_test_netconnection.yml
author: frack113, Huntrule Team
date: 2022-01-23
tags:
  - attack.command-and-control
  - attack.t1571
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains|all:
      - Test-NetConnection
      - "-ComputerName "
      - "-port "
  filter:
    ScriptBlockText|contains:
      - " 443 "
      - " 80 "
  condition: selection and not filter
falsepositives:
  - Legitimate administrative script
level: medium
license: DRL-1.1
related:
  - id: adf876b3-f1f8-4aa9-a4e4-a64106feec06
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL