| 加固项 | 连接可观测性 |
|---|---|
| 适用平台 | Windows |
| 风险等级 | 中 |
| 基线 | 外连均有业务解释 |
外连清单
外连清单
Get-NetTCPConnection -State Established | Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, OwningProcess | Sort-Object RemoteAddress | Format-Table -AutoSize
netstat -anob | Select-String -Pattern 'ESTABLISHED' | Select-Object -First 30常见矿池端口线索
常见矿池端口线索
Get-NetTCPConnection -State Established | Where-Object {$_.RemotePort -in 3333,4444,5555,7777,8888,9999,14444,45700} | Select-Object RemoteAddress, RemotePort, OwningProcess出方向控制与连接巡检配合：出网白名单（见防火墙分组）让异常外连“连不出去”，巡检让异常“看得见”。