I am seeing some suspicious activity on windows 2008 web server. There are some connection attempts being made from the server going out to foreign IP addresses without any legit reason.
The connection attempts are rare, they last only for few seconds. What can I use or How can I find what process in the server has created the socket? It doesn't last for long time so I am thinking of something that will take a snapshot of processes in those few seconds, plus give me the actual process or the actual executable file/dll that opened the socket. Sysinternal TCPview and doing packet capture I can think of, but they are difficult since I don't know when the next connection attempt wil be made. Any better ideas?