{"id":"bd33d2aa-497e-4651-9893-5c5364646595","title":"Suspicious TCP Tunnel Via PowerShell Script","description":"Detects powershell scripts that creates sockets/listeners which could be indicative of tunneling activity","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-07-08","modified":"","tags":["attack.command-and-control","attack.t1090"],"technique_ids":["T1090"],"logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"falsepositives":["Unknown"],"references":["https://github.com/Arno0x/PowerShellScripts/blob/a6b7d5490fbf0b20f91195838f3a11156724b4f7/proxyTunnel.ps1"],"source_path":"rules/windows/powershell/powershell_script/posh_ps_susp_proxy_scripts.yml","source_sha256":"8b93f93f1143b391b3a60c275c5c4203401f5161bf391771aad720615659524b","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_susp_proxy_scripts.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious TCP Tunnel Via PowerShell Script\nid: bd33d2aa-497e-4651-9893-5c5364646595\nstatus: test\ndescription: Detects powershell scripts that creates sockets/listeners which could be indicative of tunneling activity\nreferences:\n    - https://github.com/Arno0x/PowerShellScripts/blob/a6b7d5490fbf0b20f91195838f3a11156724b4f7/proxyTunnel.ps1\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-07-08\ntags:\n    - attack.command-and-control\n    - attack.t1090\nlogsource:\n    product: windows\n    category: ps_script\n    definition: 'Requirements: Script Block Logging must be enabled'\ndetection:\n    selection:\n        ScriptBlockText|contains|all:\n            - '[System.Net.HttpWebRequest]'\n            - 'System.Net.Sockets.TcpListener'\n            - 'AcceptTcpClient'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1090","id":"T1090","name":"Proxy","page":"techniques/enterprise/T1090/"}],"data_path":"data/detection-rules/bd33d2aa-497e-4651-9893-5c5364646595.json","kind":"sigma"}