System Network Connections Discovery - Windows (PowerShell)

id: '16272.24664'
title: System Network Connections Discovery - Windows
description: 'Adversaries may attempt to get a listing of network connections to or
  from the compromised system they are currently accessing or from remote systems
  by querying for information over the network. -- Threat Actor Association: Alloy
  Taurus/Gallium, Volt Typhoon -- Atomics T1049 Test #1 Atomics T1049 Test #2'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") "netstat" OR ("net"
  ("use" or "sessions")) OR TERM(Get-NetTCPConnection) | regex process="(?i)netstat(\.exe)?|net(\.exe)?\s+(use|sessions)|Get-TCPConnection"
  | table _time, host, user process, process_* | bin span=1s | stats values(*) as
  * by _time, host '
techniques:
- discovery:system network connections discovery
technique_id: 
- T1049
data_category:
- PowerShell logs
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1049/T1049.md#atomic-test-1---system-network-connections-discovery
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1049/T1049.md#atomic-test-2---system-network-connections-discovery-with-powershell