Skip to main content

Lab 6.1: Windows Network Analysis

Learning Objectives​

By the end of this lab, you will be able to:

  • Analyze active network connections
  • Identify processes communicating over the network
  • Detect suspicious connections
  • Use Windows network tools

Estimated Duration​

45 minutes

Prerequisites​

  • Windows 10/11 VM
  • Administrator rights
  • Basic network knowledge

Professional Context​

Network analysis is essential for:

  • Intrusion detection
  • Malware identification
  • Security auditing
  • Troubleshooting

Part 1: Basic Commands​

Step 1.1: netstat​

:: Established connections
netstat -an | findstr ESTABLISHED

:: With process PID
netstat -ano

:: With process names (requires admin)
netstat -anob

:: Protocol statistics
netstat -s

Step 1.2: Modern PowerShell​

# TCP connections
Get-NetTCPConnection

# Established connections only
Get-NetTCPConnection -State Established

# With process details
Get-NetTCPConnection -State Established | 
    Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, 
    @{N='Process';E={(Get-Process -Id $_.OwningProcess).Name}}, OwningProcess |
    Format-Table -AutoSize

# UDP connections
Get-NetUDPEndpoint

Step 1.3: Listening Ports​

# Listening TCP ports
Get-NetTCPConnection -State Listen | 
    Select-Object LocalAddress, LocalPort, 
    @{N='Process';E={(Get-Process -Id $_.OwningProcess).Name}} |
    Sort-Object LocalPort

# Check a specific port
Get-NetTCPConnection -LocalPort 445

Question 1: What ports are listening on your system?

Part 2: Network Process Analysis​

Step 2.1: Identify Processes​

# Processes with network connections
$connections = Get-NetTCPConnection -State Established
$processes = $connections | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    [PSCustomObject]@{
        Process = $proc.Name
        PID = $_.OwningProcess
        LocalPort = $_.LocalPort
        RemoteAddress = $_.RemoteAddress
        RemotePort = $_.RemotePort
        Path = $proc.Path
    }
}
$processes | Format-Table -AutoSize

Step 2.2: Group by Process​

# Number of connections per process
Get-NetTCPConnection -State Established | 
    Group-Object OwningProcess | 
    ForEach-Object {
        $proc = Get-Process -Id $_.Name -ErrorAction SilentlyContinue
        [PSCustomObject]@{
            Process = $proc.Name
            Connections = $_.Count
            Path = $proc.Path
        }
    } | Sort-Object Connections -Descending

Step 2.3: Suspicious Processes​

# Non-system processes with connections
$systemPaths = @("C:\Windows", "C:\Program Files", "C:\Program Files (x86)")

Get-NetTCPConnection -State Established | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    if ($proc.Path) {
        $isSystem = $false
        foreach ($path in $systemPaths) {
            if ($proc.Path -like "$path*") { $isSystem = $true; break }
        }
        if (-not $isSystem) {
            [PSCustomObject]@{
                Process = $proc.Name
                Remote = "$($_.RemoteAddress):$($_.RemotePort)"
                Path = $proc.Path
            }
        }
    }
} | Format-Table -AutoSize

Question 2: Are there any non-system processes with network connections?

Part 3: Detection of Suspicious Connections​

Step 3.1: Suspicious Ports​

# Ports often used by malware/C2
$suspectPorts = @(4444, 5555, 6666, 1337, 31337, 8080, 8443, 9999)

$suspectConnections = Get-NetTCPConnection | Where-Object {
    $_.RemotePort -in $suspectPorts -or $_.LocalPort -in $suspectPorts
}

if ($suspectConnections) {
    Write-Host "[ALERT] Connections on suspicious ports:" -ForegroundColor Red
    $suspectConnections | Select-Object LocalPort, RemoteAddress, RemotePort, State,
        @{N='Process';E={(Get-Process -Id $_.OwningProcess).Name}} |
        Format-Table -AutoSize
} else {
    Write-Host "[OK] No connections on suspicious ports" -ForegroundColor Green
}

Step 3.2: Connections to High-Risk Countries​

# Note: Requires a GeoIP database for accuracy
# Here we detect non-RFC1918 (public) IPs

$publicConnections = Get-NetTCPConnection -State Established | Where-Object {
    $ip = $_.RemoteAddress
    $ip -notmatch "^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.|::1|0\.0\.0\.0)"
}

Write-Host "Connections to public IPs:" -ForegroundColor Yellow
$publicConnections | Select-Object RemoteAddress, RemotePort,
    @{N='Process';E={(Get-Process -Id $_.OwningProcess).Name}} |
    Format-Table -AutoSize

Step 3.3: Complete Detection Script​

# Suspicious connections detection script
Write-Host "=== NETWORK SECURITY ANALYSIS ===" -ForegroundColor Cyan

$alerts = @()

# 1. Suspicious ports
$suspectPorts = @(4444, 5555, 6666, 1337, 31337, 8080, 8443, 9999, 1234)
Get-NetTCPConnection | Where-Object {
    $_.RemotePort -in $suspectPorts -or $_.LocalPort -in $suspectPorts
} | ForEach-Object {
    $alerts += [PSCustomObject]@{
        Type = "Suspicious Port"
        Detail = "Port $($_.RemotePort) or $($_.LocalPort)"
        Remote = $_.RemoteAddress
        Process = (Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).Name
    }
}

# 2. Unusual processes with network
$normalNetworkProcs = @("svchost", "System", "chrome", "firefox", "msedge", 
    "explorer", "OneDrive", "Teams", "Outlook", "Code")

Get-NetTCPConnection -State Established | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    if ($proc.Name -notin $normalNetworkProcs -and $proc.Name) {
        $alerts += [PSCustomObject]@{
            Type = "Unusual Process"
            Detail = $proc.Name
            Remote = "$($_.RemoteAddress):$($_.RemotePort)"
            Process = $proc.Name
        }
    }
}

# 3. PowerShell with connections
Get-NetTCPConnection -State Established | Where-Object {
    (Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).Name -eq "powershell"
} | ForEach-Object {
    $alerts += [PSCustomObject]@{
        Type = "PowerShell Network"
        Detail = "PowerShell has active connections"
        Remote = "$($_.RemoteAddress):$($_.RemotePort)"
        Process = "powershell"
    }
}

# Report
Write-Host "`n=== RESULTS ===" -ForegroundColor Yellow
if ($alerts.Count -eq 0) {
    Write-Host "[OK] No anomalies detected" -ForegroundColor Green
} else {
    Write-Host "[!] $($alerts.Count) anomaly(s) detected:" -ForegroundColor Red
    $alerts | Format-Table -AutoSize
}

# Summary
Write-Host "`n=== STATISTICS ===" -ForegroundColor Cyan
$established = (Get-NetTCPConnection -State Established).Count
$listening = (Get-NetTCPConnection -State Listen).Count
Write-Host "Established connections: $established"
Write-Host "Listening ports: $listening"

Part 4: Firewall Configuration​

Step 4.1: Firewall Status​

# Profile status
Get-NetFirewallProfile | Select-Object Name, Enabled

# Active rules (inbound)
Get-NetFirewallRule -Direction Inbound -Enabled True | 
    Select-Object DisplayName, Action, Profile |
    Format-Table -AutoSize

Step 4.2: Rules for a Port​

# Rules for port 445 (SMB)
Get-NetFirewallPortFilter -Protocol TCP | Where-Object LocalPort -eq 445 | 
    Get-NetFirewallRule | 
    Select-Object DisplayName, Enabled, Action

Step 4.3: Create a Blocking Rule​

# Block outbound connections on a suspicious port
New-NetFirewallRule -DisplayName "Block Suspicious Port 4444" `
    -Direction Outbound `
    -LocalPort 4444 `
    -Protocol TCP `
    -Action Block

# Verify
Get-NetFirewallRule -DisplayName "Block Suspicious*"

# Remove (after the lab)
# Remove-NetFirewallRule -DisplayName "Block Suspicious Port 4444"

Part 5: Practical Exercise​

Step 5.1: Complete Network Audit​

Create a script network_audit.ps1:

# Complete network audit
$report = @()

Write-Host "=== NETWORK AUDIT ===" -ForegroundColor Cyan
Write-Host "Date: $(Get-Date)"
Write-Host ""

# 1. Network interfaces
Write-Host "[1/4] Network interfaces..." -ForegroundColor Yellow
Get-NetAdapter | Where-Object Status -eq "Up" | 
    Select-Object Name, InterfaceDescription, LinkSpeed |
    Format-Table -AutoSize

# 2. IP configuration
Write-Host "[2/4] IP configuration..." -ForegroundColor Yellow
Get-NetIPAddress -AddressFamily IPv4 | 
    Where-Object {$_.IPAddress -ne "127.0.0.1"} |
    Select-Object InterfaceAlias, IPAddress, PrefixLength |
    Format-Table -AutoSize

# 3. Listening ports
Write-Host "[3/4] Listening ports..." -ForegroundColor Yellow
Get-NetTCPConnection -State Listen | 
    Select-Object LocalPort, @{N='Process';E={(Get-Process -Id $_.OwningProcess).Name}} |
    Sort-Object LocalPort -Unique |
    Format-Table -AutoSize

# 4. Established connections
Write-Host "[4/4] Top 10 connections..." -ForegroundColor Yellow
Get-NetTCPConnection -State Established | 
    Select-Object -First 10 LocalPort, RemoteAddress, RemotePort,
    @{N='Process';E={(Get-Process -Id $_.OwningProcess).Name}} |
    Format-Table -AutoSize

Write-Host "`n=== END OF AUDIT ===" -ForegroundColor Cyan

Deliverables​

  1. Answers to the 2 questions

  2. Screenshots:

    • List of established connections
    • Listening ports
    • Detection script executed

  3. Customized audit script

  4. Report (1 page):

    • Identified connections
    • Detected anomalies
    • Recommendations

Evaluation Criteria​

CriteriaPoints
Basic commands20%
Process analysis25%
Suspicious detection30%
Audit script25%

Reference Commands​

# Connections
Get-NetTCPConnection
Get-NetUDPEndpoint
netstat -ano

# Filtering
-State Established, Listen
-LocalPort 443
-RemotePort 80

# Firewall
Get-NetFirewallProfile
Get-NetFirewallRule
New-NetFirewallRule

Lab developed as part of the Operating Systems course - MODULE 6