check-network

Network Security Check

Analyze active network connections, listening ports, and detect suspicious network activity that may indicate malware communication.

Network Analysis Tasks

1. Active Network Connections

# All active TCP connections with process info
netstat -ano | findstr ESTABLISHED

# Get detailed connection info with process names
Get-NetTCPConnection | Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, State, OwningProcess

2. Listening Ports

# All listening ports
netstat -ano | findstr LISTENING

# Services listening on all interfaces (0.0.0.0)
Get-NetTCPConnection -State Listen | Where-Object {$_.LocalAddress -eq '0.0.0.0'}

3. Process-to-Network Mapping

# Map connections to process names
Get-NetTCPConnection | ForEach-Object {
    $process = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    [PSCustomObject]@{
        LocalAddress = $_.LocalAddress
        LocalPort = $_.LocalPort
        RemoteAddress = $_.RemoteAddress
        RemotePort = $_.RemotePort
        State = $_.State
        ProcessId = $_.OwningProcess
        ProcessName = $process.ProcessName
        ProcessPath = $process.Path
    }
}

4. DNS Cache

# View DNS resolution cache
Get-DnsClientCache | Select-Object Entry, Data, TimeToLive

5. Firewall Rules

# Check for suspicious firewall rules
Get-NetFirewallRule | Where-Object {$_.Enabled -eq $true -and $_.Direction -eq 'Inbound'}

Suspicious Indicators

High-Risk Connections

1. Unusual Remote Ports

• Common malware ports: 1337, 31337, 4444, 5555, 6666, 6667
• IRC ports: 6660-6669
• RAT ports: 1080 (socks), 3389 (RDP), 5900 (VNC)
• Tor: 9001, 9030, 9050, 9051

2. Suspicious Remote IPs

• Connections to unexpected countries
• Known malicious IP ranges
• Dynamic DNS domains
• Recently registered domains

3. Unusual Process Behavior

• svchost.exe - Should not make external connections (usually)
• rundll32.exe - Suspicious if connecting to internet
• regsvr32.exe - Should not have network activity
• User processes from temp directories with network access
• Unsigned processes with active connections