Lab 6.1: Analyse Reseau Windows

Objectifs d'Apprentissage

A la fin de ce laboratoire, vous serez capable de:

• Analyser les connexions reseau actives
• Identifier les processus qui communiquent sur le reseau
• Detecter les connexions suspectes
• Utiliser les outils reseau Windows

Duree Estimee

45 minutes

Prerequis

• VM Windows 10/11
• Droits administrateur
• Connaissances reseau de base

Contexte Professionnel

L'analyse reseau est essentielle pour:

• Detection d'intrusions
• Identification de malwares
• Audit de securite
• Troubleshooting

---

Partie 1: Commandes de Base

Etape 1.1: netstat

:: Connexions etablies
netstat -an | findstr ESTABLISHED

:: Avec PID des processus
netstat -ano

:: Avec noms des processus (necessite admin)
netstat -anob

:: Statistiques par protocole
netstat -s

Etape 1.2: PowerShell moderne

# Connexions TCP
Get-NetTCPConnection

# Connexions etablies uniquement
Get-NetTCPConnection -State Established

# Avec details du processus
Get-NetTCPConnection -State Established | 
    Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, 
    @{N='Process';E={(Get-Process -Id $_.OwningProcess).Name}}, OwningProcess |
    Format-Table -AutoSize

# Connexions UDP
Get-NetUDPEndpoint

Etape 1.3: Ports en ecoute

# Ports TCP en ecoute
Get-NetTCPConnection -State Listen | 
    Select-Object LocalAddress, LocalPort, 
    @{N='Process';E={(Get-Process -Id $_.OwningProcess).Name}} |
    Sort-Object LocalPort

# Verifier un port specifique
Get-NetTCPConnection -LocalPort 445

Question 1: Quels ports sont en ecoute sur votre systeme?

---

Partie 2: Analyse des Processus Reseau

Etape 2.1: Identifier les processus

# Processus avec connexions reseau
$connections = Get-NetTCPConnection -State Established
$processes = $connections | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    [PSCustomObject]@{
        Process = $proc.Name
        PID = $_.OwningProcess
        LocalPort = $_.LocalPort
        RemoteAddress = $_.RemoteAddress
        RemotePort = $_.RemotePort
        Path = $proc.Path
    }
}
$processes | Format-Table -AutoSize

Etape 2.2: Grouper par processus

# Nombre de connexions par processus
Get-NetTCPConnection -State Established | 
    Group-Object OwningProcess | 
    ForEach-Object {
        $proc = Get-Process -Id $_.Name -ErrorAction SilentlyContinue
        [PSCustomObject]@{
            Process = $proc.Name
            Connections = $_.Count
            Path = $proc.Path
        }
    } | Sort-Object Connections -Descending

Etape 2.3: Processus suspects

# Processus non-systeme avec connexions
$systemPaths = @("C:\Windows", "C:\Program Files", "C:\Program Files (x86)")

Get-NetTCPConnection -State Established | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    if ($proc.Path) {
        $isSystem = $false
        foreach ($path in $systemPaths) {
            if ($proc.Path -like "$path*") { $isSystem = $true; break }
        }
        if (-not $isSystem) {
            [PSCustomObject]@{
                Process = $proc.Name
                Remote = "$($_.RemoteAddress):$($_.RemotePort)"
                Path = $proc.Path
            }
        }
    }
} | Format-Table -AutoSize

Question 2: Y a-t-il des processus non-systeme avec des connexions reseau?

---

Partie 3: Detection de Connexions Suspectes

Etape 3.1: Ports suspects

# Ports souvent utilises par les malwares/C2
$suspectPorts = @(4444, 5555, 6666, 1337, 31337, 8080, 8443, 9999)

$suspectConnections = Get-NetTCPConnection | Where-Object {
    $_.RemotePort -in $suspectPorts -or $_.LocalPort -in $suspectPorts
}

if ($suspectConnections) {
    Write-Host "[ALERTE] Connexions sur ports suspects:" -ForegroundColor Red
    $suspectConnections | Select-Object LocalPort, RemoteAddress, RemotePort, State,
        @{N='Process';E={(Get-Process -Id $_.OwningProcess).Name}} |
        Format-Table -AutoSize
} else {
    Write-Host "[OK] Aucune connexion sur ports suspects" -ForegroundColor Green
}

Etape 3.2: Connexions vers pays a risque

# Note: Necessite une base de donnees GeoIP pour etre precis
# Ici on detecte les IPs non-RFC1918 (publiques)

$publicConnections = Get-NetTCPConnection -State Established | Where-Object {
    $ip = $_.RemoteAddress
    $ip -notmatch "^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.|::1|0\.0\.0\.0)"
}

Write-Host "Connexions vers IPs publiques:" -ForegroundColor Yellow
$publicConnections | Select-Object RemoteAddress, RemotePort,
    @{N='Process';E={(Get-Process -Id $_.OwningProcess).Name}} |
    Format-Table -AutoSize

Etape 3.3: Script de detection complet

# Script de detection de connexions suspectes
Write-Host "=== ANALYSE RESEAU SECURITE ===" -ForegroundColor Cyan

$alerts = @()

# 1. Ports suspects
$suspectPorts = @(4444, 5555, 6666, 1337, 31337, 8080, 8443, 9999, 1234)
Get-NetTCPConnection | Where-Object {
    $_.RemotePort -in $suspectPorts -or $_.LocalPort -in $suspectPorts
} | ForEach-Object {
    $alerts += [PSCustomObject]@{
        Type = "Port Suspect"
        Detail = "Port $($_.RemotePort) ou $($_.LocalPort)"
        Remote = $_.RemoteAddress
        Process = (Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).Name
    }
}

# 2. Processus inhabituels avec reseau
$normalNetworkProcs = @("svchost", "System", "chrome", "firefox", "msedge", 
    "explorer", "OneDrive", "Teams", "Outlook", "Code")

Get-NetTCPConnection -State Established | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    if ($proc.Name -notin $normalNetworkProcs -and $proc.Name) {
        $alerts += [PSCustomObject]@{
            Type = "Processus Inhabituel"
            Detail = $proc.Name
            Remote = "$($_.RemoteAddress):$($_.RemotePort)"
            Process = $proc.Name
        }
    }
}

# 3. PowerShell avec connexions
Get-NetTCPConnection -State Established | Where-Object {
    (Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).Name -eq "powershell"
} | ForEach-Object {
    $alerts += [PSCustomObject]@{
        Type = "PowerShell Reseau"
        Detail = "PowerShell a des connexions actives"
        Remote = "$($_.RemoteAddress):$($_.RemotePort)"
        Process = "powershell"
    }
}

# Rapport
Write-Host "`n=== RESULTATS ===" -ForegroundColor Yellow
if ($alerts.Count -eq 0) {
    Write-Host "[OK] Aucune anomalie detectee" -ForegroundColor Green
} else {
    Write-Host "[!] $($alerts.Count) anomalie(s) detectee(s):" -ForegroundColor Red
    $alerts | Format-Table -AutoSize
}

# Resume
Write-Host "`n=== STATISTIQUES ===" -ForegroundColor Cyan
$established = (Get-NetTCPConnection -State Established).Count
$listening = (Get-NetTCPConnection -State Listen).Count
Write-Host "Connexions etablies: $established"
Write-Host "Ports en ecoute: $listening"

---

Partie 4: Configuration Pare-feu

Etape 4.1: Etat du pare-feu

# Statut des profils
Get-NetFirewallProfile | Select-Object Name, Enabled

# Regles actives (entrant)
Get-NetFirewallRule -Direction Inbound -Enabled True | 
    Select-Object DisplayName, Action, Profile |
    Format-Table -AutoSize

Etape 4.2: Regles pour un port

# Regles pour le port 445 (SMB)
Get-NetFirewallPortFilter -Protocol TCP | Where-Object LocalPort -eq 445 | 
    Get-NetFirewallRule | 
    Select-Object DisplayName, Enabled, Action

Etape 4.3: Creer une regle de blocage

# Bloquer les connexions sortantes sur un port suspect
New-NetFirewallRule -DisplayName "Block Suspicious Port 4444" `
    -Direction Outbound `
    -LocalPort 4444 `
    -Protocol TCP `
    -Action Block

# Verifier
Get-NetFirewallRule -DisplayName "Block Suspicious*"

# Supprimer (apres le lab)
# Remove-NetFirewallRule -DisplayName "Block Suspicious Port 4444"

---

Partie 5: Exercice Pratique

Etape 5.1: Audit reseau complet

Creez un script audit_reseau.ps1:

# Audit reseau complet
$report = @()

Write-Host "=== AUDIT RESEAU ===" -ForegroundColor Cyan
Write-Host "Date: $(Get-Date)"
Write-Host ""

# 1. Interfaces reseau
Write-Host "[1/4] Interfaces reseau..." -ForegroundColor Yellow
Get-NetAdapter | Where-Object Status -eq "Up" | 
    Select-Object Name, InterfaceDescription, LinkSpeed |
    Format-Table -AutoSize

# 2. Configuration IP
Write-Host "[2/4] Configuration IP..." -ForegroundColor Yellow
Get-NetIPAddress -AddressFamily IPv4 | 
    Where-Object {$_.IPAddress -ne "127.0.0.1"} |
    Select-Object InterfaceAlias, IPAddress, PrefixLength |
    Format-Table -AutoSize

# 3. Ports en ecoute
Write-Host "[3/4] Ports en ecoute..." -ForegroundColor Yellow
Get-NetTCPConnection -State Listen | 
    Select-Object LocalPort, @{N='Process';E={(Get-Process -Id $_.OwningProcess).Name}} |
    Sort-Object LocalPort -Unique |
    Format-Table -AutoSize

# 4. Connexions etablies
Write-Host "[4/4] Top 10 connexions..." -ForegroundColor Yellow
Get-NetTCPConnection -State Established | 
    Select-Object -First 10 LocalPort, RemoteAddress, RemotePort,
    @{N='Process';E={(Get-Process -Id $_.OwningProcess).Name}} |
    Format-Table -AutoSize

Write-Host "`n=== FIN AUDIT ===" -ForegroundColor Cyan

---

Livrables

1. Reponses aux 2 questions

2. Captures d'ecran:

   • Liste des connexions etablies
   • Ports en ecoute
   • Script de detection execute

3. Script d'audit personnalise

4. Rapport (1 page):

   • Connexions identifiees
   • Anomalies detectees
   • Recommandations

---

Criteres d'Evaluation

Critere	Points
Commandes de base	20%
Analyse processus	25%
Detection suspectes	30%
Script d'audit	25%

---

Commandes de Reference

# Connexions
Get-NetTCPConnection
Get-NetUDPEndpoint
netstat -ano

# Filtrage
-State Established, Listen
-LocalPort 443
-RemotePort 80

# Pare-feu
Get-NetFirewallProfile
Get-NetFirewallRule
New-NetFirewallRule

---

Lab developpe dans le cadre du cours Systemes d'Exploitation - MODULE 6