Network Connections
Every connection and listening port on a machine belongs to a process, and Windows records which. An investigator reads the pair, this process and that address, because a program with no reason to talk is one of the clearest signs of code running inside it. Normal is a process whose connections fit its job. A service host carries the traffic of the services it hosts, and Windows' own file sharing on port 445 comes from the System process. Look first at connections to internet addresses from processes with no reason to make them, such as the print spooler.
What It Is
A connection is a conversation between a program on this machine and a program on another. Each end is an address, which names the machine, and a port, a number that names the program it is for.
- Why Windows Needs It
- Many programs share one network card, so Windows' network stack notes the process that owns every connection. That is how each reply reaches the right program.
- An Everyday Example
- When alice opens a web page in Edge, msedge.exe connects to port 443 on the web server, and Windows notes msedge.exe as the owner. Windows file sharing, SMB, uses port 445, and the System process carries it for every program.
msedge.exe203.0.113.10:443A web page, over HTTPS (port 443)System192.0.2.30:445A file share, over SMB (port 445)spoolsv.exe198.51.100.23:443The print spooler on ws-042. It serves printers, so an internet address needs a reason.
- Kept by the Kernel
- The kernel's network stack keeps every connection and listener, with the ID of the process that owns it.
Connection States
Each TCP row carries a state, which netstat and Get-NetTCPConnection both print. Get-NetUDPEndpoint gives a UDP endpoint its local address and owner but no state.
A live tool shows what is open now. In a memory image, windows.netscan also finds objects left from connections that have closed, while windows.netstat walks the network stack's own lists for what was open at capture. A row only the scan finds is not yet a hidden connection.
Most rows you will read are Listen, a port waiting for others to connect, or Established, an open conversation. The rest are connections opening or closing.
TCP states to read first, as Get-NetTCPConnection names them
| State | What It Shows | Worth a Look When |
|---|---|---|
| Listen | A port this machine listens on | A process with no reason to listen does, or on an odd port |
| SynSent | A connection this machine has asked for, with no answer yet | A process with no network role is trying to reach the internet |
| Established | An open connection to the remote address | A process with no network role holds one to the internet |
| CloseWait | Waiting for the program on this machine to close the connection | A process with no network role still holds one to the internet |
| TimeWait | A connection being closed, waiting to be sure the remote end got the final acknowledgement | The address is one no process here has reason to reach |
| Closed | A connection that has ended, though a memory scan can still find its object | Read windows.netstat before calling it live |
What Normal Looks Like
On a healthy machine this part looks like this.
- Each process's connections fit its job, so judge a svchost.exe copy by the services it hosts.
- Windows file sharing (SMB) uses port 445, and legitimate connections there are generally made by the kernel, shown as the System process (PID 4).
- Windows components and services talk to Microsoft's own endpoints, so a system process reaching the internet is not a finding on its own.
- A memory scan also finds connections that have closed, so read the state, and set windows.netscan against windows.netstat, before calling one live.
Why It Matters
A process with no reason to talk, such as the print spooler reaching the internet, is one of the clearest signs of code running inside it. The check is the pair, this process and that address.
Normal and Suspicious
A clean machine sits beside a suspicious one, and the pointer marks where to look.
Normal
A clean Windows 11 install
| Protocol | Local Address | Remote Address | State |
|---|---|---|---|
| TCP | 192.0.2.60:50318 | to 192.0.2.30:445 | Established |
Suspicious
ws-042,
| Protocol | Local Address | Remote Address | State |
|---|---|---|---|
| TCP | 192.0.2.42:49712 | to 198.51.100.23:443 | Established |
| Remote AddressAn internet address: the print spooler serves printers and print clients, so this needs a reason. Network Connections That Should Not Exist | |||
What a Malicious Example Shows
Each card is what malicious use of this part looks like, and where it shows.
- A process that needs a reason to reach the internet, such as the print spooler, holding an established connection to an internet address.Where it shows: windows.netscan or windows.netstat with the owner, or Device
Network Events with Connection Success and Sysmon event 3 where those run. - A program other than System connecting to port 445 on other machines.Where it shows: Sysmon event 3, Device
Network Events or windows.netscan rows for remote port 445 owned by a process other than PID 4. - A web protocol on a port it does not normally use.Where it shows: Connections to an unusual port from a process that speaks HTTP.
- A raw protocol, neither HTTP nor DNS, from a process that never uses one.Where it shows: TCP or UDP sessions with no matching application protocol.
- A listener in a process that has no reason to listen, beside its connections to other internal hosts.Where it shows: Windows.
Network. Listening Ports or windows.netstat for the listener, and the same process in the connection records.
Live and in Memory
Each question has the tools that answer it on a running machine, and in a memory image, a copy of its memory saved to a file.
Every TCP connection, listening port and UDP endpoint belongs to a process, and the check is whether this program has any reason to talk, and to there. Live tools show what is open now, and a memory image gives a scan for network objects to set against a walk of the network stack's own lists. Telemetry adds the connections that opened and closed before anyone looked.
Which process owns each connection and listening port?
On a Running Machine
- netstat (documentation, opens in a new tab)Live Machine A command built into Windows that lists network connections and the process that owns each.
netstat -anoEvery connection and listening port with its state and owning PID. It can also name the executable, given enough permissions. - Get-NetTCPConnection (documentation, opens in a new tab)Live Machine A PowerShell command built into Windows that lists TCP connections and the process that owns each.
Get-NetTCPConnectionEach TCP connection with its state, OwningProcess and creation time, to join to the process list. - Get-NetUDPEndpoint (documentation, opens in a new tab)Live Machine A PowerShell command built into Windows that lists UDP ports and the process that owns each.
Get-NetUDPEndpointEach UDP endpoint with its local address, OwningProcess and creation time. - TCPView (documentation, opens in a new tab)Live Machine A free Microsoft tool that lists every network connection with the process that owns it. The same, live, with the process that owns each endpoint and its service name where it has one.
In a Memory Image
windows.netscan(documentation, opens in a new tab)Memory Image A Volatility 3 plugin. It is one check run on a saved copy of a Windows machine's memory. netscan means network scan. Connections and listeners found by scanning memory, with addresses, state, owning PID and process, and a creation time.windows.netstat(documentation, opens in a new tab)Memory Image A Volatility 3 plugin. It is one check run on a saved copy of a Windows machine's memory. Walks the network stack's own lists for what was open at capture. An object only the scan finds may have closed, so read its state before calling it hidden.
- netstat (documentation, opens in a new tab)Live Machine A command built into Windows that lists network connections and the process that owns each.
Has a process connected before, and to where?
On a Running Machine
Device(documentation, opens in a new tab)Logs and Records A Defender XDR table. It holds the records Defender for Endpoint keeps of what happened on each machine, and you search it with KQL. Each connection with its remote address, port and URL, tied to the process that made it and its command line.Network Events Generic.(documentation, opens in a new tab)Live Machine A Velociraptor artifact. It is a ready-made question Velociraptor asks of running machines, named from general to specific. Polls every few seconds and reports new and closed connections with process details, for as long as it runs.Events. Track Network Connections
In a Memory Image
windows.netscan(documentation, opens in a new tab)Memory Image A Volatility 3 plugin. It is one check run on a saved copy of a Windows machine's memory. netscan means network scan. Each network object's creation time, to line a connection up with the rest of the timeline.
Which processes listen, and on what?
On a Running Machine
Windows.(documentation, opens in a new tab)Live Machine A Velociraptor artifact. It is a ready-made question Velociraptor asks of running machines, named from general to specific. Processes with listening ports across many machines, with address, protocol and PID.Network. Listening Ports - Get-NetTCPConnection (documentation, opens in a new tab)Live Machine A PowerShell command built into Windows that lists TCP connections and the process that owns each.
Get-NetTCPConnectionTCP listeners show in the Listen state, each with its OwningProcess.
In a Memory Image
windows.netstat(documentation, opens in a new tab)Memory Image A Volatility 3 plugin. It is one check run on a saved copy of a Windows machine's memory. The listeners on the live lists at capture, each with its owning process.
A connection that opened and closed before anyone looked leaves no live trace. These records keep it, with the process behind it, where they are switched on.
Records of a connection and a name lookup
| Record | Fields to Read | What It Tells You |
|---|---|---|
| Sysmon event 3 | Image, Initiated, Destination | A TCP or UDP connection and the process behind it. Initiated is true when that process opened it, and the event is off by default |
| Sysmon event 22 | Image, Query | The name a process looked up, whether or not the lookup succeeded and whether or not the answer was cached |
| Device | Action | Defender's record of each connection and the process that made it |
What It Misses
Every way of looking has gaps, so cover these from another source.
- A connection that opened and closed between two looks leaves nothing live. Only telemetry such as Sysmon event 3 or DeviceNetworkEvents kept it.
- Traffic the kernel and its drivers carry belongs to the System process, not to the program that asked for it, so that program never appears beside the connection. Line System's connections up with what other processes did at that moment.
False Positives
These look odd but are normal, so rule them out before you act.
- Windows components and services send data to Microsoft's own endpoints, so a system process talking to the internet is not a finding on its own. Judge the destination with the process.
Red Flags It Explains
Each red flag below is confirmed by reading this part.
- Network Connections That Should Not Exist Tie each connection to its process, with Get-NetTCPConnection or netstat live, or windows.netscan in a memory image, which can also list closed ones while memory still holds them.
- Remote Thread Injection Tie its connections to it, live with Get-NetTCPConnection and in memory with windows.netscan. A connection its job never needs, such as the print spooler reaching the internet, points to code that is not its own.
- Abused Built-In and Admin Tools Check what it reached. A connection from rundll32.exe or regsvr32.exe to a public address is a published detection, and so is either one making a connection with no command line.
Checks That Use It
These checks read this part as one of their steps.
Hunt It
The same hunt is written for four tools, so pick the one you use. Defender XDR and Sentinel queries are in KQL, which you paste into Advanced hunting in the Defender portal or into Sentinel's Logs page. Splunk queries are in SPL, for its Search page, and Velociraptor queries are in VQL, which you run as a hunt.
Needs Defender for Endpoint on every device. A program seen on few devices talking to the internet is a lead, not proof of anything sent. Check whether it has any reason to, and what else that address reached.
// Programs that connected to public addresses, rarest first, with where they connectedDeviceNetworkEvents| where Timestamp > ago(Sources
- Microsoft Learn: netstat (opens in a new tab)
- Microsoft Learn: service overview and network port requirements (opens in a new tab)
- Microsoft Learn: Get-NetTCPConnection (opens in a new tab)
- Microsoft Learn: Get-NetUDPEndpoint (opens in a new tab)
- Microsoft Learn: MIB_TCPROW_LH structure (what each TCP state means) (opens in a new tab)
- Microsoft Sysinternals: TCPView (opens in a new tab)
- Elastic: SMB Connections via LOLBin or Untrusted Process (opens in a new tab)
- Microsoft Learn: build queries in guided mode (ConnectionSuccess) (opens in a new tab)
- Microsoft Sysinternals: Sysmon (opens in a new tab)
- Microsoft Sentinel: ASIM Sysmon network session parser (opens in a new tab)
- Microsoft Learn: DeviceNetworkEvents table (opens in a new tab)
- Microsoft Learn: how to troubleshoot high CPU in the System process (opens in a new tab)
- Microsoft Learn: connection endpoints for Windows 11 Enterprise (opens in a new tab)
- Velociraptor: Windows.Network.Netstat (opens in a new tab)
- Velociraptor: Windows.Network.NetstatEnriched (opens in a new tab)
- Velociraptor: Windows.Network.ListeningPorts (opens in a new tab)
- Velociraptor exchange: Generic.Events.TrackNetworkConnections (opens in a new tab)
- Volatility 3: windows.netscan (opens in a new tab)
- Volatility 3 source: netscan.py (opens in a new tab)
- Volatility 3: windows.netstat (opens in a new tab)
MITRE ATT&CK is a free public catalogue of the techniques attackers use. Each technique has an ID, such as T1055 for Process Injection, so defenders can name the same behaviour the same way. Reading this part helps find these techniques.
- T1071.001 (opens in a new tab) Application Layer Protocol: Web Protocols
- T1055 (opens in a new tab) Process Injection
- T1021.002 (opens in a new tab) Remote Services: SMB/Windows Admin Shares
- T1571 (opens in a new tab) Non-Standard Port
- T1095 (opens in a new tab) Non-Application Layer Protocol
- T1090.001 (opens in a new tab) Proxy: Internal Proxy