| 加固项 | 端口最小化 |
|---|---|
| 适用平台 | Windows |
| 风险等级 | 中 |
| 基线 | 监听端口均有业务归属 |
清单与映射
清单与映射
Get-NetTCPConnection -State Listen | Select-Object LocalAddress, LocalPort, OwningProcess | Sort-Object LocalPort | Format-Table -AutoSize
netstat -ano | findstr LISTENING | Select-Object -First 40
Get-Process -Id (Get-NetTCPConnection -State Listen -LocalPort 445).OwningProcess | Select-Object Name, Path只看对外地址
只看对外地址
Get-NetTCPConnection -State Listen | Where-Object {$_.LocalAddress -notin '127.0.0.1','::1'} | Select-Object LocalAddress, LocalPort, OwningProcessWindows 的端口与进程映射稳定可靠：把“对外监听清单”做成基线快照，异常变化可快速定位。