CmdID

CmdID / PowerShell / Cmdlets / Test

Test-NetConnection

Displays diagnostic information for a connection. Windows Server PowerShell reference

From the Windows Server PowerShell reference 9 parameters 1 Sigma rule looks for it Its page in the reference

Opens CmdID with your command, read as PowerShell. It is read in your browser and sent nowhere.

Parameters

9 in the Windows Server PowerShell reference
-CommonTCPPortSpecifies the common service TCP port number.
-ComputerName, -RemoteAddress, -cnSpecifies the Domain Name System (DNS) name or IP address of the target computer.
-ConstrainInterfaceSpecifies the interface constraint to use for route diagnostics.
-ConstrainSourceAddressSpecifies the source address constraint to use for route diagnostics.
-DiagnoseRoutingIndicates that route diagnostics runs to output the route and source address selection information for the remote host.
-HopsSpecifies the number of hops to traverse in a trace route command.
-InformationLevelSpecifies the information level.
-Port, -RemotePortSpecifies the TCP port number on the remote computer.
-TraceRouteIndicates that Tracert runs to test connectivity to the remote host.

What looks for it

Sigma process creation rules that name Test-NetConnection
highWebshell Detection With Command Line KeywordsFlorian Roth (Nextron Systems), Jonhnathan Ribeiro, Anton Kutepov, oscd.community, Chad Hudson, Matt Anderson