Detection of Non-Standard Network Port Usage via PowerShell

Adversaries frequently employ techniques to evade network monitoring by utilizing protocols and port pairings that are not traditionally associated with specific traffic types. By establishing command-and-control (C2) channels over non-standard ports, such as 8088 or 587, attackers attempt to blend in with authorized traffic and bypass static firewall rules or simple inspection policies. The PowerShell cmdlet Test-NetConnection is often misused by attackers during the post-exploitation reconnaissance phase to verify reachability and ensure that a target host can communicate with external C2 infrastructure over these unconventional ports. This brief focuses on the detection of such reconnaissance activity using PowerShell Script Block Logging, which provides visibility into the parameters passed to network diagnostic commands.

Impact

Successful exploitation of non-standard port communication allows attackers to maintain persistent, covert C2 channels, potentially leading to unauthorized data exfiltration, lateral movement, or long-term remote administration of compromised endpoints. Detecting this activity early in the network reconnaissance phase is critical to preventing the establishment of a stable C2 infrastructure and mitigating further compromise within the target environment.

Recommendation

Detection engineering teams should focus on identifying suspicious usage of network connectivity tools in scripting environments.

• Enable PowerShell Script Block Logging (Event ID 4104) across all Windows endpoints to capture the command-line arguments used in administrative tools.
• Deploy the Sigma rule provided below to the SIEM and tune the filter list to exclude known administrative or monitoring tools specific to the local network environment.
• Monitor logs for instances of Test-NetConnection where the destination port does not align with standardized port assignments (e.g., ports other than 80, 443).