Use Get-NetTCPConnection - PowerShell Module — Detection Rule
Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.