I have the following predicament. I am tasked with making sure our client's workstations are squeaky clean from a Malware point of view. We have been blessed with Websense as a malicious outbound traffic identifying tool.
Let's say for a given host I see some suspicious traffic and I want to identify what's the process that is causing it (the workstations are Win 7 32 bit).
Also netstat helps only if the process is always running. For scarce traffic the offending process is not always obvious.
The pain comes from the following: we only have a pseudo - administrator account with which we have only remote command line access. No powershell, no ability to run programs with GUI (i. e. Process explorer), and we are required to minimally interrupt the users during their work.
Because of this I am trying to master the hidden art of netsh trace. But for longer periods of time, even though I add filters for ethernet type, protocol and ip, the logs get huge with entries for Windows kernel, and it's taking forever to download them from the host for analysis.
Until now I have not found any way to cut those out. I figured there must be a way with scenarios and/or providers, but could not find a description for those anywhere.
I also did not find a way to do this using any SysInternals tool just from the CLI.
Any suggestions for tools or methods to accomplish the task?