| 核心 | Get-NetTCPConnection |
|---|---|
| 过滤 | -State Established / -RemoteAddress |
| 定位进程 | OwningProcess + Get-Process |
| UDP | Get-NetUDPEndpoint |
外联与进程对照
外联与进程对照
Get-NetTCPConnection -State Established | Select-Object LocalAddress,LocalPort,RemoteAddress,RemotePort,OwningProcess | Sort-Object RemoteAddress
Get-NetTCPConnection -State Listen | Sort-Object LocalPort
Get-NetTCPConnection -State Established | Where-Object RemoteAddress -ne '127.0.0.1' | ForEach-Object { [pscustomobject]@{Remote="$($_.RemoteAddress):$($_.RemotePort)"; Proc=(Get-Process -Id $_.OwningProcess).ProcessName} }很多正常业务也连公网：判断要看端口与进程组合，而不是有公网连接就判恶意。