[Rule modification] Testing Usage of Uncommonly Used Port

This rule caught my attention, because the title seemed to be referring to the logic too vaguely. After inspecting it a bit more, I've got additional doubts about the rule. Here they are:

• Looking at references and description, primarly the red atomic reference, it seems that the rule should alert on suspicious pairings of protocol + port.
• The rule matches usage of Test-NetConnection which is a network diagnostic tool
• The red atomic uses that tool as an example for this technique, but it's just one of the many ways to execute it.
• Additionally, the Mitre ATT&CK seems to align with the other metadata, but not with the logic.

The way I see it is that the detection should work on a logsource, that allows to inspect protocol and target port. The logic in the detection can be used to detect e.g. outbound port scanning, but that's a whole different detection.

The options are (I believe):

• Deprecate it
• Change metadata to match logic
• Change the logic to match metadata, but that results in essentially new rule (working on new logsource)

---

I am happy to work on this detection to resolve the issue, but I am not sure how it should be handled.

EDIT: Sorry for not using a template, but I don't think it matches either of them.