blue-team-tools/rules/windows/powershell/powershell_script/posh_ps_test_netconnection.yml

title: Testing Usage of Uncommonly Used Port
id: adf876b3-f1f8-4aa9-a4e4-a64106feec06
status: experimental
description: |
  Adversaries may communicate using a protocol and port paring that are typically not associated.
  For example, HTTPS over port 8088(Citation: Symantec Elfin Mar 2019) or port 587(Citation: Fortinet Agent Tesla April 2018) as opposed to the traditional port 443. 
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1571/T1571.md#atomic-test-1---testing-usage-of-uncommonly-used-port-with-powershell
    - https://docs.microsoft.com/en-us/powershell/module/nettcpip/test-netconnection?view=windowsserver2022-ps
author: frack113
date: 2022/01/23
logsource:
    product: windows
    category: ps_script
detection:
    selection:
        ScriptBlockText|contains|all:
            - Test-NetConnection
            - '-ComputerName '
            - '-port '
    filter:
        ScriptBlockText|contains:
            - ' 443 '
            - ' 80 '
    condition: selection and not filter
falsepositives:
  - Legitimate administrative script
level: medium
tags:
  - attack.command_and_control
  - attack.t1571