Use Get-NetTCPConnection - PowerShell Module

Title: Use Get-NetTCPConnection - PowerShell Module
Status: test
Description:Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1049/T1049.md#atomic-test-2---system-network-connections-discovery-with-powershell
Author: frack113
Date: 2021-12-10
modified:2022-12-02
Tags:

• -'attack.discovery'
• -'attack.t1049'

Logsource:

• product: windows
• category: ps_module
• definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b

Detection:
  selection:
    ContextInfo|contains: 'Get-NetTCPConnection'
  condition:selection
Falsepositives:
  -Unknown
Level: low