Enumeration of local network connections from the command line

Siemphony@siemphonylowT1049unverifiedPlaybook · Discovery and enumeration

Matches process creation whose command line names a connection-listing utility — netstat in any path or casing form, the Get-NetTCPConnection and Get-NetUDPEndpoint cmdlets, and net session. The whole test is on CommandLine rather than split between Image and CommandLine because the cmdlet form never appears as an Image: it is an argument of powershell.exe, so one field carries both shapes and no backend has to OR across two. This populates MITRE's CommandPatternList knob; MITRE names the knob, the four patterns are authored here. ATT&CK also names "net use", which is deliberately left out — "net use" is a substring of "net user" (account discovery, T1087), and bare net use is drive mapping on every domain workstation at logon, so including it would swamp the rule with a match it cannot even attribute to the right technique. Two blind spots: a cmdlet typed at an interactive PowerShell prompt spawns no process and is visible only in Script Block Logging (EventID 4104, the brief's other Windows feed, which is off unless Script Block Logging is enabled), and the same cmdlet inside an -EncodedCommand blob does not match at all. The rule is written in the Sysmon EventID 1 vocabulary of the brief's first log source; if the estate feeds Security 4688 into this category instead, CommandLine is populated only when both Audit Process Creation and the separate Include command line in process creation events policy are on, and without them the rule returns zero rows for want of the field rather than for want of the behaviour. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0320, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: Enumeration of local network connections from the command line2id: c5c78cc4-9d31-4d8d-aee8-0089d05038dd3status: experimental4description: |5  Matches process creation whose command line names a connection-listing6  utility — netstat in any path or casing form, the Get-NetTCPConnection and7  Get-NetUDPEndpoint cmdlets, and net session. The whole test is on8  CommandLine rather than split between Image and CommandLine because the9  cmdlet form never appears as an Image: it is an argument of powershell.exe,10  so one field carries both shapes and no backend has to OR across two.11  This populates MITRE's CommandPatternList knob; MITRE names the knob, the12  four patterns are authored here. ATT&CK also names "net use", which is13  deliberately left out — "net use" is a substring of "net user" (account14  discovery, T1087), and bare net use is drive mapping on every domain15  workstation at logon, so including it would swamp the rule with a match it16  cannot even attribute to the right technique. Two blind spots: a cmdlet17  typed at an interactive PowerShell prompt spawns no process and is visible18  only in Script Block Logging (EventID 4104, the brief's other Windows feed,19  which is off unless Script Block Logging is enabled), and the same cmdlet20  inside an -EncodedCommand blob does not match at all. The rule is written in21  the Sysmon EventID 1 vocabulary of the brief's first log source; if the22  estate feeds Security 4688 into this category instead, CommandLine is23  populated only when both Audit Process Creation and the separate Include24  command line in process creation events policy are on, and without them the25  rule returns zero rows for want of the field rather than for want of the26  behaviour.27  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0320, not hand-written and not tested by its author. Any lab result is on this rule's own page.28references:29  - https://attack.mitre.org/techniques/T104930  - https://attack.mitre.org/detectionstrategies/DET032031author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)32date: 2026-08-1633tags:34  - attack.discovery35  - attack.t104936logsource:37  category: process_creation38  product: windows39detection:40  selection:41    CommandLine|contains:42      - 'netstat'43      - 'Get-NetTCPConnection'44      - 'Get-NetUDPEndpoint'45      - 'net session'46  condition: selection47falsepositives:48  - "Monitoring, inventory and EDR health agents that shell out to netstat -ano on a polling interval to record listening ports; on any host running one of these the rule fires every cycle and is the highest-volume match by a wide margin."49  - "Helpdesk and administrator connectivity troubleshooting, where netstat -ano and Get-NetTCPConnection are among the first commands typed in an elevated prompt during an incident or a port-conflict investigation."50  - "Application installers and service start-up scripts that call netstat to check whether a listening port is already taken before binding to it, which fires on every install and on every service restart."51  - "PowerShell configuration and remediation scripts — Intune remediations, DSC resources, load-balancer and cluster health checks — that call Get-NetTCPConnection to assert a service is listening."52level: low

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (ProcessCommandLine contains "netstat" or ProcessCommandLine contains "Get-NetTCPConnection" or ProcessCommandLine contains "Get-NetUDPEndpoint" or ProcessCommandLine contains "net session")

Splunk · SPL

Run this as a search.

index=* (CommandLine="*netstat*" OR CommandLine="*Get-NetTCPConnection*" OR CommandLine="*Get-NetUDPEndpoint*" OR CommandLine="*net session*")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(process.command_line) LIKE "*netstat*" OR TO_LOWER(process.command_line) LIKE "*get-nettcpconnection*" OR TO_LOWER(process.command_line) LIKE "*get-netudpendpoint*" OR TO_LOWER(process.command_line) LIKE "*net session*")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)(netstat|Get-NetTCPConnection|Get-NetUDPEndpoint|net session)</field>    <description>Enumeration of local network connections from the command line</description>    <mitre>      <id>T1049</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: low
Category: discovery_recon
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: c5c78cc4-9d31-4d8d-aee8-0089d05038dd

ATT&CKT1049

T1049System Network Connections Discovery

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification2 runs

Not verified

Security Datasets — Remote sessions enumerated via NetSessEnum (Empire)
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.
Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1049, evaluated against their process_creation events.

Using it

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Suppress by parent and by account first: exclude your monitoring agents' service accounts and their parent process paths rather than removing netstat from the pattern list. Then use MITRE's SuspiciousParentProcesses knob in the opposite direction — promote severity when the parent is an Office application, a script host, w3wp.exe or an unsigned binary. MITRE's TimeWindow knob, correlating this discovery with the lateral movement that follows, is where the real signal is; Sigma models no timeframe, so build it in your platform.

Declared by the author

Monitoring, inventory and EDR health agents that shell out to netstat -ano on a polling interval to record listening ports; on any host running one of these the rule fires every cycle and is the highest-volume match by a wide margin.
Helpdesk and administrator connectivity troubleshooting, where netstat -ano and Get-NetTCPConnection are among the first commands typed in an elevated prompt during an incident or a port-conflict investigation.
Application installers and service start-up scripts that call netstat to check whether a listening port is already taken before binding to it, which fires on every install and on every service restart.
PowerShell configuration and remediation scripts — Intune remediations, DSC resources, load-balancer and cluster health checks — that call Get-NetTCPConnection to assert a service is listening.

Lessondiscovery recon

discovery reconAI draft — unreviewed

01 · What this rule detects

A process launched with a connection-listing utility named on its command line. MITRE's AN0903 describes commands, binaries and API calls used to enumerate local or remote network connections, and this rule takes the command-line half: netstat in any path or casing form, the Get-NetTCPConnection and Get-NetUDPEndpoint cmdlets, and net session. It is discovery telemetry — the adversary mapping what the host is talking to, usually just before deciding where to move next.

02 · Telemetry you need

logsource: category: process_creation, product: windows, copied verbatim from the brief's first log source, which means Sysmon EventID 1 vocabulary. If your estate feeds Security 4688 into this category instead, CommandLine is only populated when both Audit Process Creation and the separate Include command line in process creation events policy are enabled. Neither is on in a default install. The entire rule tests CommandLine and nothing else, so without those policies it returns zero rows for want of the field rather than for want of the behaviour — the failure mode that looks identical to a clean environment.

03 · How the logic works

There is one selection block and it is deliberately plain:

The whole test lives on CommandLine rather than being split between Image and CommandLine for a specific reason. The cmdlet forms never appear as an Image — Get-NetTCPConnection is an argument of powershell.exe, not a binary. Putting everything on one field lets a single selection carry both shapes, and it means no backend has to OR across two different fields, which Wazuh in particular refuses. Matching netstat as a substring also survives full paths, .exe suffixes and mixed casing without four separate entries. This populates MITRE's CommandPatternList knob. MITRE names the knob and gives netstat and Get-NetTCPConnection as examples; the four patterns as written here are authored, not taken from ATT&CK. ATT&CK also names net use, which is deliberately excluded. net use is a substring of net user, which is account discovery (T1087), so including it would drag in matches this rule cannot even attribute to the right technique — and bare net use is drive mapping at logon on every domain workstation. Two blind spots worth stating. A cmdlet typed at an interactive PowerShell prompt spawns no process at all and is visible only in Script Block Logging (EventID 4104, the brief's other Windows feed, off unless explicitly enabled). And the same cmdlet inside an -EncodedCommand blob does not match, because the literal string never reaches the visible command line.

04 · Common false positives

Very. Monitoring, inventory and EDR health agents shell out to netstat -ano on a polling interval to record listening ports; on any host running one of those this fires every cycle and is the highest-volume match by a wide margin. Admins and helpdesk type netstat -ano first during any connectivity or port-conflict investigation. Installers and service start-up scripts call netstat to check whether a port is already bound, so it fires on every install and restart. Intune remediations, DSC resources and cluster health checks call Get-NetTCPConnection to assert a service is listening. That top entry is what sets the level at low.

05 · Detection maturity

tier_1: Lowest tier. Machine-derived from ATT&CK v19.2 and never executed against a log line. It stays there until its volume is measured on live data.

Related detections6 nearby

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/c5c78cc4-9d31-4d8d-aee8-0089d05038dd

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Enumeration of local network connections from the command line

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it