Windows process and socket capture

Question

I am seeing some suspicious activity on windows 2008 web server. There are some connection attempts being made from the server going out to foreign IP addresses without any legit reason.

The connection attempts are rare, they last only for few seconds. What can I use or How can I find what process in the server has created the socket? It doesn't last for long time so I am thinking of something that will take a snapshot of processes in those few seconds, plus give me the actual process or the actual executable file/dll that opened the socket. Sysinternal TCPview and doing packet capture I can think of, but they are difficult since I don't know when the next connection attempt wil be made. Any better ideas?

Answer 1

I suggest running Network Monitor (from Microsoft themselves) continuously, with a big buffer. NM works with a RAM buffer to save the captured data, and when the buffer is full, old packets are discarded; so you can let it run unattended. Then wait for one of the suspicious connections to happen; at that point, stop the capture and save the trace.

This will give you a fair bit of context (if your buffer is wide enough, a few minutes or even hours of previous traffic). Moreover, NM tries to link data exchanges with the processes (and even when it fails, you can use the trace to understand what was happening on the machine at that precise time, and thus pinpoint the probable culprit).

It also seems that NM can be automated to some extent.

Answer 2

That would concern me too! One way you could attack this is to use netstat -rnb from the command line, the -b will show the executable that has opened each connection. As the sessions probably last a short time you probably won't have time to execute this manually so you will need to script something. Here's 2 ways you can go about this:

• super easy method: write a simple script that will simply pipe the output to a file over and over until you interrupt it. The command would be "netstat -rnb >> file.txt". The simplest possible way to do this would be to create a batch file, say netst.bat, and have 2 lines in it:

netstat -rnb >> file.txt

netst.bat

Drawbacks to this method are that the file will get very big very quickly, you'd need to monitor it closely to make sure it doesn't get out of hand, or you can use powershell's select-string to filter on port number if it is consistent. Once you have seen the suspicious traffic you can simply search the file for the IP address you saw, and the executable should be there unless whomever wrote it is extremely clever.

• the other, slightly more complicated way would be to write a script that would run netstat -rnb over and over again looking for the traffic you have seen and stop when it sees it, outputting the information you are looking for. The only thing is you need to know what you are looking for, if there's a wide range of IP addresses and ports this may not be practical, and it assumes you have some scripting knowledge.