Live network connections

Location & availability

Get-NetTCPConnection, netstat or a trusted live network inspection tool

Connections can open and close between observations. Permissions and PID reuse affect attribution.

Fields to examine

• Local and remote address/port, state and observation time.
• Owning PID and contemporaneous process identity.
• Creation information only where the source/tool actually supplies it.

What it can establish

• Support an observed endpoint/state association with a process at collection.

What it cannot prove

• Prove what data was transferred or that a shared IP hosts a specific service.
• Treat a later process with the same PID as the earlier owner.

Use it in a screenshare

1. Capture the connection table and process identity together before closing applications.
2. Resolve the owning image, user, start context and available hash without relying on a friendly process name.
3. Compare endpoints with retained firewall/Sysmon events. Explain CDN/shared-hosting ambiguity and encrypted content limitations.

Worked example

A helper process has an established connection to an address used by many services. That supports the observed connection. Identifying a specific remote application or transferred payload requires more than the IP alone.

Cross-check the finding

• Sysmon event logs →Link configured process telemetry and subsequent events through ProcessGuid.
• Windows Firewall logs →Support a recorded permit/drop event according to the log format.
• Live processes and loaded modules →Support that a process or module was visible at the observation time.

Sources

• Microsoft — Get-NetTCPConnection ↗