Potential Powershell ReverseShell Connection

Title: Potential Powershell ReverseShell Connection
Status: stable
Description:Detects usage of the "TcpClient" class. Which can be abused to establish remote connections and reverse-shells. As seen used by the Nishang "Invoke-PowerShellTcpOneLine" reverse shell and other.
References:
  -https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/
  -https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/
  -https://github.com/samratashok/nishang/blob/414ee1104526d7057f9adaeee196d91ae447283e/Shells/Invoke-PowerShellTcpOneLine.ps1
Author: FPT.EagleEye, wagga, Nasreddine Bencherchali (Nextron Systems)
Date: 2021-03-03
modified:2023-04-05
Tags:

• -'attack.execution'
• -'attack.t1059.001'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
    - OriginalFileName:
      - 'PowerShell.EXE'
      - 'pwsh.dll'
    - Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_cli:
    CommandLine|contains|all:
      -' Net.Sockets.TCPClient'
      -'.GetStream('
      -'.Write('

  condition:all of selection_*
Falsepositives:
  -In rare administrative cases, this function might be used to check network connectivity
Level: high