Network Connections That Should Not Exist

Red Flags

Every connection belongs to a process, and most Windows processes have a narrow job, so the print spooler serves printers and print clients. Some reach out by design, such as a service host fetching updates or a spooler printing to a web address, but a process whose job never needs the internet does not hold a connection to an internet address. Such a connection usually means code running inside a genuine process and talking in its name, or a program under a borrowed name reaching whoever runs it. Tie each connection to its process first, then ask whether that process has any reason to reach that address.

Normal and Suspicious

A clean machine sits beside a suspicious one, and the pointer marks where to look.

Normal

A clean Windows 11 install

System (PID 4) to a file server on port 445, Windows' own file sharing made by the kernel. Example values.
ProtocolRemote AddressState
TCPto 192.0.2.30:445Established

Suspicious

ws-042,

spoolsv.exe (PID 3268) on ws-042 at 10:08 on 12 Oct 2026, with the connection open since 10:07:31.
ProtocolRemote AddressState
TCPto 198.51.100.23:443Established
Remote AddressAn internet address: the print spooler serves printers and print clients, so this needs a reason. Network Connections That Should Not Exist
See It in the Window

Look Inside

Why It Matters

Malware has to reach whoever runs it, and code injected into a genuine process talks in that process's name. A core process or a print spooler holding an internet connection is that traffic showing.

How to Confirm It

Work through these in order. Each step names the page that shows how.

  1. Tie each connection to its process, with Get-NetTCPConnection or netstat live, or windows.netscan in a memory image, which can also list closed ones while memory still holds them.Network Connections
  2. Check the owner against its profile. A genuine process with a connection it has no reason for points to code running inside it.Process Listings and Scans
  3. Read the owner's threads and where each one starts. A thread that starts in memory no file backs is a lead to code running inside it.Threads
  4. Read its memory regions. A private region created to run and be written, with no file behind it, is a lead, not proof, since just-in-time compilers make them too.Memory Regions
  5. Pull the DNS queries and the first connection time (Sysmon events 22 and 3, DeviceNetworkEvents) and set them on the timeline.Network Connections

What Defenders See

Each record names its log and what must be switched on to get it.

Record and Where It LandsWhat to ReadHow to Turn It On
3 Network connection (opens in a new tab)Microsoft-Windows-Sysmon/OperationalIt is written on any Windows computer running Sysmon.Image, DestinationIp, DestinationPort and Initiated for each connection. It is off by default, and it carries no command line.Network Connections shows how to read it.Run Sysmon with NetworkConnect events in its configuration. They are off by default.
22 DNSEvent (DNS query) (opens in a new tab)Microsoft-Windows-Sysmon/OperationalIt is written on any Windows computer running Sysmon.QueryName and the process behind each DNS lookup, the name a connection was meant for.Network Connections shows how to read it.Run Sysmon with DnsQuery events in its configuration.
DeviceNetworkEvents (opens in a new tab)Each row is a network connection or a related event, tied to the process that made it.Defender XDR, advanced huntingRemoteIP, RemotePort, RemoteUrl and RemoteIPType with the initiating process and its command line.The Defender for Endpoint sensor on the device
DeviceFileCertificateInfo (opens in a new tab)Each row is the signing certificate of a file seen on devices. It says whether the signature is embedded or comes from a catalogue file, and whether it is trusted.Defender XDR, advanced huntingThe signer of the connecting binary, joined on SHA1. An unsigned or untrusted file talking out is FalconForce's hunt.The Defender for Endpoint sensor on the device
False Positives

A spooler sending jobs to a printer at a web address, through Windows' HTTP print provider, and service hosts that fetch updates reach out by design, so check the address against what the process is for.

Blind Spots

Sysmon's network event is off by default and carries no command line, so the owner's arguments come from its creation record.

A connection that closed before a live check may no longer show in netstat. windows.netscan may still find it while memory holds it, and Sysmon or DeviceNetworkEvents keep a record.

Hunt It

The same hunt is written for four tools, so pick the one you use. Defender XDR and Sentinel queries are in KQL, which you paste into Advanced hunting in the Defender portal or into Sentinel's Logs page. Splunk queries are in SPL, for its Search page, and Velociraptor queries are in VQL, which you run as a hunt.

Sees It DirectlyDeviceNetworkEvents (documentation, opens in a new tab)

Needs Defender for Endpoint. ActionType says what kind of connection each row is. A hit is one to explain, as printers, cloud print services and updates come first, and anything left points to the process itself.

KQLDefender XDR, Advanced hunting
// Core Windows processes, and built-in proxies started with no arguments, in connections with public addressesDeviceNetworkEvents| where Timestamp > ago(30d)| where RemoteIPType == "Public"| extend Process = tolower(InitiatingProcessFileName)| where Process in ("spoolsv.exe", "lsass.exe", "winlogon.exe", "services.exe", "wininit.exe", "csrss.exe", "smss.exe")    or (Process in ("rundll32.exe", "regsvr32.exe", "dllhost.exe")        and InitiatingProcessCommandLine matches regex @"(?i)(rundll32|regsvr32|dllhost)(\.exe)?\W*$")| summarize Connections = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Ports = make_set(RemotePort, 10)    by DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, ActionType, RemoteIP, RemoteUrl| order by FirstSeen desc

In a Memory Image

Volatility 3 reads a memory image, and each of its plugins below shows part of this sign.

  • windows.netscan (documentation, opens in a new tab)Memory Image A Volatility 3 plugin. It is one check run on a saved copy of a Windows machine's memory. netscan means network scan. Connections and listeners found by scanning memory, closed ones included while memory still holds them, each with its owning process and creation time.
  • windows.netstat (documentation, opens in a new tab)Memory Image A Volatility 3 plugin. It is one check run on a saved copy of a Windows machine's memory. The connections the network stack itself was tracking at capture.
  • windows.malware.malfind (documentation, opens in a new tab)Memory Image A Volatility 3 plugin from its malware group. It checks a memory image for code that hides, or code put into a process. malfind means find malware. If the owner is genuine, private executable memory in it, where injected code can sit. A clean result does not clear it.
  • windows.malware.suspicious_threads (documentation, opens in a new tab)Memory Image A Volatility 3 plugin from its malware group. It checks a memory image for code that hides, or code put into a process. Live threads in the owner that start outside every file-backed image.

Rules to Compare With

Security vendors publish detection rules anyone can read. These look for the same thing, so compare your own with them.

Show the 7 Public Rules

How to Prevent It

Each control helps prevent it, and its line says what it does here.

Related

Where It Matters Most
  • spoolsv.exe A connection to an internet address with no printer or print server behind it.
  • winlogon.exe Any connection it starts to a public address. Microsoft treats outbound connections from it as highly suspicious.
Travels with
  • Remote Thread Injection A genuine process with a connection it has no reason for may have code running inside it, as the spooler on ws-042 did.
Check It in the Registry
Windows Firewall Rules

Sources

MITRE ATT&CK is a free public catalogue of the techniques attackers use. Each technique has an ID, such as T1055 for Process Injection, so defenders can name the same behaviour the same way. This red flag can point to these techniques.