Lab 6.1: Análisis de Red en Windows

Objetivos de Aprendizaje

Al final de este laboratorio, usted será capaz de:

• Analizar las conexiones de red activas
• Identificar los procesos que se comunican en la red
• Detectar conexiones sospechosas
• Utilizar las herramientas de red de Windows

Duración Estimada

45 minutos

Prerrequisitos

• VM Windows 10/11
• Derechos de administrador
• Conocimientos básicos de redes

Contexto Profesional

El análisis de red es esencial para:

• Detección de intrusiones
• Identificación de malware
• Auditoría de seguridad
• Resolución de problemas

---

Parte 1: Comandos Básicos

Paso 1.1: netstat

:: Connexions etablies
netstat -an | findstr ESTABLISHED

:: Avec PID des processus
netstat -ano

:: Avec noms des processus (necessite admin)
netstat -anob

:: Statistiques par protocole
netstat -s

Paso 1.2: PowerShell moderno

# Connexions TCP
Get-NetTCPConnection

# Connexions etablies uniquement
Get-NetTCPConnection -State Established

# Avec details du processus
Get-NetTCPConnection -State Established | 
    Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, 
    @{N='Process';E={(Get-Process -Id $_.OwningProcess).Name}}, OwningProcess |
    Format-Table -AutoSize

# Connexions UDP
Get-NetUDPEndpoint

Paso 1.3: Puertos en escucha

# Ports TCP en ecoute
Get-NetTCPConnection -State Listen | 
    Select-Object LocalAddress, LocalPort, 
    @{N='Process';E={(Get-Process -Id $_.OwningProcess).Name}} |
    Sort-Object LocalPort

# Verifier un port specifique
Get-NetTCPConnection -LocalPort 445

Pregunta 1: ¿Qué puertos están en escucha en su sistema?

---

Parte 2: Análisis de Procesos de Red

Paso 2.1: Identificar los procesos

# Processus avec connexions reseau
$connections = Get-NetTCPConnection -State Established
$processes = $connections | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    [PSCustomObject]@{
        Process = $proc.Name
        PID = $_.OwningProcess
        LocalPort = $_.LocalPort
        RemoteAddress = $_.RemoteAddress
        RemotePort = $_.RemotePort
        Path = $proc.Path
    }
}
$processes | Format-Table -AutoSize

Paso 2.2: Agrupar por proceso

# Nombre de connexions par processus
Get-NetTCPConnection -State Established | 
    Group-Object OwningProcess | 
    ForEach-Object {
        $proc = Get-Process -Id $_.Name -ErrorAction SilentlyContinue
        [PSCustomObject]@{
            Process = $proc.Name
            Connections = $_.Count
            Path = $proc.Path
        }
    } | Sort-Object Connections -Descending

Paso 2.3: Procesos sospechosos

# Processus non-systeme avec connexions
$systemPaths = @("C:\Windows", "C:\Program Files", "C:\Program Files (x86)")

Get-NetTCPConnection -State Established | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    if ($proc.Path) {
        $isSystem = $false
        foreach ($path in $systemPaths) {
            if ($proc.Path -like "$path*") { $isSystem = $true; break }
        }
        if (-not $isSystem) {
            [PSCustomObject]@{
                Process = $proc.Name
                Remote = "$($_.RemoteAddress):$($_.RemotePort)"
                Path = $proc.Path
            }
        }
    }
} | Format-Table -AutoSize

Pregunta 2: ¿Hay procesos no del sistema con conexiones de red?

---

Parte 3: Detección de Conexiones Sospechosas

Paso 3.1: Puertos sospechosos

# Ports souvent utilises par les malwares/C2
$suspectPorts = @(4444, 5555, 6666, 1337, 31337, 8080, 8443, 9999)

$suspectConnections = Get-NetTCPConnection | Where-Object {
    $_.RemotePort -in $suspectPorts -or $_.LocalPort -in $suspectPorts
}

if ($suspectConnections) {
    Write-Host "[ALERTE] Connexions sur ports suspects:" -ForegroundColor Red
    $suspectConnections | Select-Object LocalPort, RemoteAddress, RemotePort, State,
        @{N='Process';E={(Get-Process -Id $_.OwningProcess).Name}} |
        Format-Table -AutoSize
} else {
    Write-Host "[OK] Aucune connexion sur ports suspects" -ForegroundColor Green
}

Paso 3.2: Conexiones hacia países de riesgo

# Note: Necessite une base de donnees GeoIP pour etre precis
# Ici on detecte les IPs non-RFC1918 (publiques)

$publicConnections = Get-NetTCPConnection -State Established | Where-Object {
    $ip = $_.RemoteAddress
    $ip -notmatch "^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.|::1|0\.0\.0\.0)"
}

Write-Host "Connexions vers IPs publiques:" -ForegroundColor Yellow
$publicConnections | Select-Object RemoteAddress, RemotePort,
    @{N='Process';E={(Get-Process -Id $_.OwningProcess).Name}} |
    Format-Table -AutoSize

Paso 3.3: Script de detección completo

# Script de detection de connexions suspectes
Write-Host "=== ANALYSE RESEAU SECURITE ===" -ForegroundColor Cyan

$alerts = @()

# 1. Ports suspects
$suspectPorts = @(4444, 5555, 6666, 1337, 31337, 8080, 8443, 9999, 1234)
Get-NetTCPConnection | Where-Object {
    $_.RemotePort -in $suspectPorts -or $_.LocalPort -in $suspectPorts
} | ForEach-Object {
    $alerts += [PSCustomObject]@{
        Type = "Port Suspect"
        Detail = "Port $($_.RemotePort) ou $($_.LocalPort)"
        Remote = $_.RemoteAddress
        Process = (Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).Name
    }
}

# 2. Processus inhabituels avec reseau
$normalNetworkProcs = @("svchost", "System", "chrome", "firefox", "msedge", 
    "explorer", "OneDrive", "Teams", "Outlook", "Code")

Get-NetTCPConnection -State Established | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    if ($proc.Name -notin $normalNetworkProcs -and $proc.Name) {
        $alerts += [PSCustomObject]@{
            Type = "Processus Inhabituel"
            Detail = $proc.Name
            Remote = "$($_.RemoteAddress):$($_.RemotePort)"
            Process = $proc.Name
        }
    }
}

# 3. PowerShell avec connexions
Get-NetTCPConnection -State Established | Where-Object {
    (Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).Name -eq "powershell"
} | ForEach-Object {
    $alerts += [PSCustomObject]@{
        Type = "PowerShell Reseau"
        Detail = "PowerShell a des connexions actives"
        Remote = "$($_.RemoteAddress):$($_.RemotePort)"
        Process = "powershell"
    }
}

# Rapport
Write-Host "`n=== RESULTATS ===" -ForegroundColor Yellow
if ($alerts.Count -eq 0) {
    Write-Host "[OK] Aucune anomalie detectee" -ForegroundColor Green
} else {
    Write-Host "[!] $($alerts.Count) anomalie(s) detectee(s):" -ForegroundColor Red
    $alerts | Format-Table -AutoSize
}

# Resume
Write-Host "`n=== STATISTIQUES ===" -ForegroundColor Cyan
$established = (Get-NetTCPConnection -State Established).Count
$listening = (Get-NetTCPConnection -State Listen).Count
Write-Host "Connexions etablies: $established"
Write-Host "Ports en ecoute: $listening"

---

Parte 4: Configuración del Firewall

Paso 4.1: Estado del firewall

# Statut des profils
Get-NetFirewallProfile | Select-Object Name, Enabled

# Regles actives (entrant)
Get-NetFirewallRule -Direction Inbound -Enabled True | 
    Select-Object DisplayName, Action, Profile |
    Format-Table -AutoSize

Paso 4.2: Reglas para un puerto

# Regles pour le port 445 (SMB)
Get-NetFirewallPortFilter -Protocol TCP | Where-Object LocalPort -eq 445 | 
    Get-NetFirewallRule | 
    Select-Object DisplayName, Enabled, Action

Paso 4.3: Crear una regla de bloqueo

# Bloquer les connexions sortantes sur un port suspect
New-NetFirewallRule -DisplayName "Block Suspicious Port 4444" `
    -Direction Outbound `
    -LocalPort 4444 `
    -Protocol TCP `
    -Action Block

# Verifier
Get-NetFirewallRule -DisplayName "Block Suspicious*"

# Supprimer (apres le lab)
# Remove-NetFirewallRule -DisplayName "Block Suspicious Port 4444"

---

Parte 5: Ejercicio Práctico

Paso 5.1: Auditoría de red completa

Cree un script audit_reseau.ps1:

# Audit reseau complet
$report = @()

Write-Host "=== AUDIT RESEAU ===" -ForegroundColor Cyan
Write-Host "Date: $(Get-Date)"
Write-Host ""

# 1. Interfaces reseau
Write-Host "[1/4] Interfaces reseau..." -ForegroundColor Yellow
Get-NetAdapter | Where-Object Status -eq "Up" | 
    Select-Object Name, InterfaceDescription, LinkSpeed |
    Format-Table -AutoSize

# 2. Configuration IP
Write-Host "[2/4] Configuration IP..." -ForegroundColor Yellow
Get-NetIPAddress -AddressFamily IPv4 | 
    Where-Object {$_.IPAddress -ne "127.0.0.1"} |
    Select-Object InterfaceAlias, IPAddress, PrefixLength |
    Format-Table -AutoSize

# 3. Ports en ecoute
Write-Host "[3/4] Ports en ecoute..." -ForegroundColor Yellow
Get-NetTCPConnection -State Listen | 
    Select-Object LocalPort, @{N='Process';E={(Get-Process -Id $_.OwningProcess).Name}} |
    Sort-Object LocalPort -Unique |
    Format-Table -AutoSize

# 4. Connexions etablies
Write-Host "[4/4] Top 10 connexions..." -ForegroundColor Yellow
Get-NetTCPConnection -State Established | 
    Select-Object -First 10 LocalPort, RemoteAddress, RemotePort,
    @{N='Process';E={(Get-Process -Id $_.OwningProcess).Name}} |
    Format-Table -AutoSize

Write-Host "`n=== FIN AUDIT ===" -ForegroundColor Cyan

---

Entregables

1. Respuestas a las 2 preguntas

2. Capturas de pantalla:

   • Lista de conexiones establecidas
   • Puertos en escucha
   • Script de detección ejecutado

3. Script de auditoría personalizado

4. Informe (1 página):

   • Conexiones identificadas
   • Anomalías detectadas
   • Recomendaciones

---

Criterios de Evaluación

Criterio	Puntos
Comandos básicos	20%
Análisis de procesos	25%
Detección de sospechosos	30%
Script de auditoría	25%

---

Comandos de Referencia

# Connexions
Get-NetTCPConnection
Get-NetUDPEndpoint
netstat -ano

# Filtrage
-State Established, Listen
-LocalPort 443
-RemotePort 80

# Pare-feu
Get-NetFirewallProfile
Get-NetFirewallRule
New-NetFirewallRule

---

Lab desarrollado en el marco del curso Sistemas Operativos - MÓDULO 6