Question Analysis

DeviceProcessEvents | where ProcessCommandLine contains 'Test-NetConnection' | extend RemotePort = tostring(extract('(?i)-Port (\\d+)', 1, ProcessCommandLine)) | where RemotePort != '' | summarize Count = count() by RemotePort | order by Count asc

DeviceProcessEvents | where tolower(FileName) in ("powershell.exe", "pwsh.exe") and tolower(ProcessCommandLine) has "test-netconnection" | extend PortExtract = extract(@"(?i)(?:-port|/port|port)(?:\s*[:=]?\s*)([0-9]{1,5})", 1, ProcessCommandLine) | extend PortNum = toint(PortExtract) | where isnotempty(PortNum) // Exclude common ports | where PortNum !in (80,443,53,3389,445,139,22,21,25,135,137,138,110,143,3306,1433,8080,8443) | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, PortNum

let commonPorts = dynamic([20,21,22,23,25,53,67,68,69,80,88,110,123,135,137,138,139,143,161,389,443,445,465,500,514,587,636,993,995,1433,1521,3306,3389,5432,5900,5985,5986,6379,8080,8443]); DeviceProcessEvents | where ActionType == "ProcessCreated" | where FileName in~ ("powershell.exe", "pwsh.exe", "powershell_ise.exe") | where ProcessCommandLine has_any ("Test-NetConnection", " tnc ") // Extract port from different ways Test-NetConnection can be used | extend PortFromParam = toint(extract(@'(?i)-Port\s*[:=]?\s*(\d{1,5})', 1, ProcessCommandLine)) | extend CommonTCP = tolower(extract(@'(?i)-CommonTCPPort\s*[:=]?\s*([A-Za-z]+)', 1, ProcessCommandLine)) | extend PortFromCommon = case( CommonTCP == "http", 80, CommonTCP == "https", 443, CommonTCP == "rdp", 3389, CommonTCP == "winrm", 5985, CommonTCP == "smb", 445, CommonTCP == "ftp", 21, CommonTCP == "telnet", 23, CommonTCP == "ssh", 22, int(null) ) // Fallback if user typed tnc host:port | extend PortFromColon = toint(extract(@'(?i)\btnc\b\s+\S+?:\s*(\d{1,5})', 1, ProcessCommandLine)) | extend PortChecked = coalesce(PortFromParam, PortFromCommon, PortFromColon) | where PortChecked between (1 .. 65535) | where PortChecked !in (commonPorts) | project TimeGenerated, DeviceName, AccountName, UncommonPort = PortChecked, ProcessCommandLine | order by TimeGenerated desc

DeviceNetworkEvents | where InitiatingProcessCommandLine contains "Test-NetConnection" | where RemotePort > 0 and RemotePort !in (20, 21, 22, 25, 53, 80, 110, 143, 443, 3389) // Filtering for uncommon ports | project DeviceName, InitiatingProcessCommandLine, RemotePort, TimeGenerated | summarize UncommonPortsChecked = make_set(RemotePort) by DeviceName // Summarizes unique uncommon ports per device

DeviceProcessEvents | where (FileName =~ "powershell.exe" or InitiatingProcessFileName =~ "powershell.exe") and (ProcessCommandLine has "Test-NetConnection" or InitiatingProcessCommandLine has "Test-NetConnection") | extend EffectiveCommandLine = coalesce(ProcessCommandLine, InitiatingProcessCommandLine) | extend ExtractedPort = toint(extract("(?i)-Port\\s+(\\d+)", 1, EffectiveCommandLine)) | where isnotempty(ExtractedPort) and ExtractedPort !in (21, 22, 25, 53, 80, 443, 135, 139, 445, 3389, 8080) | project TimeGenerated, DeviceName, AccountDomain, AccountName, ExtractedPort, EffectiveCommandLine | order by TimeGenerated desc

// Identify PowerShell Test-NetConnection executions that specify a non-standard (uncommon) port // --------------------------------------------------------------------------------------------------- // 1. Define a list of well-known / routinely used ports that we want to ignore. let CommonPorts = dynamic([ 20,21,22,23,25,53,67,68,69,80,110,123,135,137,138,139,143,161, 389,443,445,465,587,636,989,990,993,995,1433,1521,3306,3389,5985,5986 ]); // 2. Pull all PowerShell processes that invoked the Test-NetConnection cmdlet and parse the value // passed to the "-Port" parameter (case-insensitive, accepts "-Port 4444" or "-Port:4444"). let PS_TestNetConn = DeviceProcessEvents | where tolower(FileName) in ("powershell.exe","pwsh.exe","powershell_ise.exe") | where ProcessCommandLine contains "test-netconnection" | extend CmdLower = tolower(ProcessCommandLine) | extend PortStr = extract(@"-port[:\s]+([0-9]{1,5})", 1, CmdLower) | where isnotempty(PortStr) | extend Port = toint(PortStr) | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, Port; // 3a. Show every individual execution that targeted an uncommon port PS_TestNetConn | where Port !in (CommonPorts) | order by TimeGenerated desc // 3b. (Answer to the question) Aggregate to see which uncommon ports were checked and how often | summarize Executions = count(), Devices = make_set(DeviceName, 10) by Port | order by Executions desc

DeviceProcessEvents | where FileName has_cs "powershell.exe" or FileName has_cs "pwsh.exe" | where tolower(ProcessCommandLine) has "test-netconnection" or tolower(ProcessCommandLine) has "tnc " | extend cmdLower = tolower(ProcessCommandLine) | extend Port = toint(coalesce( extract(@"-port(?:=|:|\s+)(\d+)", 1, cmdLower), extract(@"-p(?:=|:|\s+)(\d+)", 1, cmdLower) )) | where Port > 0 // exclude common ports | where Port !in (80, 443, 3389, 22, 21, 23, 25, 110, 143, 53, 445) | summarize Count = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by Port | order by Count desc | project Port, Count, FirstSeen, LastSeen

DeviceProcessEvents | where FileName in~ ("powershell.exe", "pwsh.exe", "powershell_ise.exe") | where ProcessCommandLine has "Test-NetConnection" | extend PortStr = extract(@"(?i)-Port\s+(\d+)", 1, ProcessCommandLine) | where isnotempty(PortStr) | extend Port = toint(PortStr) | where Port !in (80, 443, 3389, 445) | distinct Port