PowerShell Encoded Command with External Non-Standard Port Network Connection

Ankit Mehta@Secvyn

•updated Jun 30, 2026•2•0•2

This rule identifies instances of PowerShell executing with an encoded command followed immediately (within 300 seconds) by an outbound network connection to a non-standard port or non-internal IP address. This behavior is indicative of a remote access tool or reverse shell establishing command and control (C2) communication.