
title: PowerShell Network Connections
author: Florian Roth
date: 2017/03/13
description: Detects a Powershell process that opens network connections - check for
  suspicious target ports and target systems - adjust to your environment (e.g. extend
  filters with company's ip range')
detection:
  SELECTION_1:
    EventID: 3
  SELECTION_2:
    Image: '*\powershell.exe'
  SELECTION_3:
    Initiated: 'true'
  SELECTION_4:
    DestinationIsIpv6: 'false'
  SELECTION_5:
    DestinationIp:
    - 10.*
    - 192.168.*
    - 172.16.*
    - 172.17.*
    - 172.18.*
    - 172.19.*
    - 172.20.*
    - 172.21.*
    - 172.22.*
    - 172.23.*
    - 172.24.*
    - 172.25.*
    - 172.26.*
    - 172.27.*
    - 172.28.*
    - 172.29.*
    - 172.30.*
    - 172.31.*
    - 127.0.0.1*
  SELECTION_6:
    DestinationIsIpv6: 'false'
  SELECTION_7:
    User: NT AUTHORITY\SYSTEM
  SELECTION_8:
    User: '*AUT*'
  SELECTION_9:
    User: '* NT*'
  condition: (SELECTION_1 and (SELECTION_2 and SELECTION_3 and SELECTION_4) and  not
    (SELECTION_5 and SELECTION_6 and SELECTION_7 and SELECTION_8 and SELECTION_9))
falsepositives:
- Administrative scripts
id: 1f21ec3f-810d-4b0e-8045-322202e22b4b
level: low
logsource:
  category: network_connection
  product: windows
modified: 2021/06/14
references:
- https://www.youtube.com/watch?v=DLtJTxMWZ2o
status: experimental
tags:
- attack.execution
- attack.t1059.001
- attack.t1086
ruletype: SIGMA
