Tag
This brief documents a detection capability for identifying potential command-and-control activity where adversaries use PowerShell to test network connectivity over non-standard, uncommon ports.