System Network Connections Discovery via netstat.exe (T1049)

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•2

Detects execution of 'netstat.exe' with specific flags ('-a', '-n', '-o', or '-b') initiated by command-line interpreters like cmd.exe, powershell.exe, wscript.exe, or cscript.exe. These flags are commonly used for network reconnaissance and discovery of active TCP connections, listening ports, and associated process IDs.