Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am seeing some suspicious activity on windows 2008 web server. There are some connection attempts being made from the server going out to foreign IP addresses without any legit reason.

The connection attempts are rare, they last only for few seconds. What can I use or How can I find what process in the server has created the socket? It doesn't last for long time so I am thinking of something that will take a snapshot of processes in those few seconds, plus give me the actual process or the actual executable file/dll that opened the socket. Sysinternal TCPview and doing packet capture I can think of, but they are difficult since I don't know when the next connection attempt wil be made. Any better ideas?

share|improve this question

2 Answers 2

up vote 3 down vote accepted

I suggest running Network Monitor (from Microsoft themselves) continuously, with a big buffer. NM works with a RAM buffer to save the captured data, and when the buffer is full, old packets are discarded; so you can let it run unattended. Then wait for one of the suspicious connections to happen; at that point, stop the capture and save the trace.

This will give you a fair bit of context (if your buffer is wide enough, a few minutes or even hours of previous traffic). Moreover, NM tries to link data exchanges with the processes (and even when it fails, you can use the trace to understand what was happening on the machine at that precise time, and thus pinpoint the probable culprit).

It also seems that NM can be automated to some extent.

share|improve this answer
    
Thanks! NM is a good tool. I was thinking of something that doesn't require installation, and doesn't consume much resources on a critical machine. –  Kapish M Aug 13 '12 at 13:50

That would concern me too! One way you could attack this is to use netstat -rnb from the command line, the -b will show the executable that has opened each connection. As the sessions probably last a short time you probably won't have time to execute this manually so you will need to script something. Here's 2 ways you can go about this:

  • super easy method: write a simple script that will simply pipe the output to a file over and over until you interrupt it. The command would be "netstat -rnb >> file.txt". The simplest possible way to do this would be to create a batch file, say netst.bat, and have 2 lines in it:

netstat -rnb >> file.txt

netst.bat

Drawbacks to this method are that the file will get very big very quickly, you'd need to monitor it closely to make sure it doesn't get out of hand, or you can use powershell's select-string to filter on port number if it is consistent. Once you have seen the suspicious traffic you can simply search the file for the IP address you saw, and the executable should be there unless whomever wrote it is extremely clever.

  • the other, slightly more complicated way would be to write a script that would run netstat -rnb over and over again looking for the traffic you have seen and stop when it sees it, outputting the information you are looking for. The only thing is you need to know what you are looking for, if there's a wide range of IP addresses and ports this may not be practical, and it assumes you have some scripting knowledge.
share|improve this answer
    
Thanks! I am trying a powershell script. –  Kapish M Aug 13 '12 at 13:50

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.