On a Windows system, identify any PowerShell Test-NetConnection executions against an uncommon port. Which port number was checked?

DeviceProcessEvents
| where ProcessCommandLine contains 'Test-NetConnection'
| extend RemotePort = tostring(extract('(?i)-Port (\\d+)', 1, ProcessCommandLine))
| where RemotePort != ''
| summarize Count = count() by RemotePort
| order by Count asc

DeviceProcessEvents
| where tolower(FileName) in ("powershell.exe", "pwsh.exe")
  and tolower(ProcessCommandLine) has "test-netconnection"
| extend PortExtract = extract(@"(?i)(?:-port|/port|port)(?:\s*[:=]?\s*)([0-9]{1,5})", 1, ProcessCommandLine)
| extend PortNum = toint(PortExtract)
| where isnotempty(PortNum)
// Exclude common ports
| where PortNum !in (80,443,53,3389,445,139,22,21,25,135,137,138,110,143,3306,1433,8080,8443)
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, PortNum

let commonPorts = dynamic([20,21,22,23,25,53,67,68,69,80,88,110,123,135,137,138,139,143,161,389,443,445,465,500,514,587,636,993,995,1433,1521,3306,3389,5432,5900,5985,5986,6379,8080,8443]);
DeviceProcessEvents
| where ActionType == "ProcessCreated"
| where FileName in~ ("powershell.exe", "pwsh.exe", "powershell_ise.exe")
| where ProcessCommandLine has_any ("Test-NetConnection", " tnc ")
// Extract port from different ways Test-NetConnection can be used
| extend PortFromParam = toint(extract(@'(?i)-Port\s*[:=]?\s*(\d{1,5})', 1, ProcessCommandLine))
| extend CommonTCP = tolower(extract(@'(?i)-CommonTCPPort\s*[:=]?\s*([A-Za-z]+)', 1, ProcessCommandLine))
| extend PortFromCommon = case(
    CommonTCP == "http", 80,
    CommonTCP == "https", 443,
    CommonTCP == "rdp", 3389,
    CommonTCP == "winrm", 5985,
    CommonTCP == "smb", 445,
    CommonTCP == "ftp", 21,
    CommonTCP == "telnet", 23,
    CommonTCP == "ssh", 22,
    int(null)
)
// Fallback if user typed tnc host:port
| extend PortFromColon = toint(extract(@'(?i)\btnc\b\s+\S+?:\s*(\d{1,5})', 1, ProcessCommandLine))
| extend PortChecked = coalesce(PortFromParam, PortFromCommon, PortFromColon)
| where PortChecked between (1 .. 65535)
| where PortChecked !in (commonPorts)
| project TimeGenerated, DeviceName, AccountName, UncommonPort = PortChecked, ProcessCommandLine
| order by TimeGenerated desc

DeviceNetworkEvents
| where InitiatingProcessCommandLine contains "Test-NetConnection"
| where RemotePort > 0 and RemotePort !in (20, 21, 22, 25, 53, 80, 110, 143, 443, 3389)  // Filtering for uncommon ports
| project DeviceName, InitiatingProcessCommandLine, RemotePort, TimeGenerated
| summarize UncommonPortsChecked = make_set(RemotePort) by DeviceName  // Summarizes unique uncommon ports per device

DeviceProcessEvents
| where (FileName =~ "powershell.exe" or InitiatingProcessFileName =~ "powershell.exe")
    and (ProcessCommandLine has "Test-NetConnection" or InitiatingProcessCommandLine has "Test-NetConnection")
| extend EffectiveCommandLine = coalesce(ProcessCommandLine, InitiatingProcessCommandLine)
| extend ExtractedPort = toint(extract("(?i)-Port\\s+(\\d+)", 1, EffectiveCommandLine))
| where isnotempty(ExtractedPort)
    and ExtractedPort !in (21, 22, 25, 53, 80, 443, 135, 139, 445, 3389, 8080)
| project TimeGenerated, DeviceName, AccountDomain, AccountName, ExtractedPort, EffectiveCommandLine
| order by TimeGenerated desc

// Identify PowerShell Test-NetConnection executions that specify a non-standard (uncommon) port
// ---------------------------------------------------------------------------------------------------
// 1. Define a list of well-known / routinely used ports that we want to ignore.
let CommonPorts = dynamic([
    20,21,22,23,25,53,67,68,69,80,110,123,135,137,138,139,143,161,
    389,443,445,465,587,636,989,990,993,995,1433,1521,3306,3389,5985,5986
]);

// 2. Pull all PowerShell processes that invoked the Test-NetConnection cmdlet and parse the value
//    passed to the "-Port" parameter (case-insensitive, accepts "-Port 4444" or "-Port:4444").
let PS_TestNetConn = DeviceProcessEvents
| where tolower(FileName) in ("powershell.exe","pwsh.exe","powershell_ise.exe")
| where ProcessCommandLine contains "test-netconnection"
| extend CmdLower = tolower(ProcessCommandLine)
| extend PortStr = extract(@"-port[:\s]+([0-9]{1,5})", 1, CmdLower)
| where isnotempty(PortStr)
| extend Port = toint(PortStr)
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, Port;

// 3a. Show every individual execution that targeted an uncommon port
PS_TestNetConn
| where Port !in (CommonPorts)
| order by TimeGenerated desc

// 3b. (Answer to the question)  Aggregate to see which uncommon ports were checked and how often
| summarize Executions = count(), Devices = make_set(DeviceName, 10) by Port
| order by Executions desc

DeviceProcessEvents
| where FileName has_cs "powershell.exe" or FileName has_cs "pwsh.exe"
| where tolower(ProcessCommandLine) has "test-netconnection" or tolower(ProcessCommandLine) has "tnc "
| extend cmdLower = tolower(ProcessCommandLine)
| extend Port = toint(coalesce(
        extract(@"-port(?:=|:|\s+)(\d+)", 1, cmdLower),
        extract(@"-p(?:=|:|\s+)(\d+)", 1, cmdLower)
    ))
| where Port > 0
// exclude common ports
| where Port !in (80, 443, 3389, 22, 21, 23, 25, 110, 143, 53, 445)
| summarize Count = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by Port
| order by Count desc
| project Port, Count, FirstSeen, LastSeen

DeviceProcessEvents
| where FileName in~ ("powershell.exe", "pwsh.exe", "powershell_ise.exe")
| where ProcessCommandLine has "Test-NetConnection"
| extend PortStr = extract(@"(?i)-Port\s+(\d+)", 1, ProcessCommandLine)
| where isnotempty(PortStr)
| extend Port = toint(PortStr)
| where Port !in (80, 443, 3389, 445)
| distinct Port