How to specify which program generates malicious traffic?

emr_1 — Thu, 03 Aug 2017 07:18:36 GMT

Hello all,

I know this question is outside of the PAN device matter.

But my customer asked me how to specify the program on his computer for removing malicious program.

Let me tell you exmaple:

When I see threat log, it shows

Src 192.168.1.1:12345

Dst 100.100.100.100:80

We can understand that we need to investigate 192.168.1.1 device.

On this device, we don't know how to specify which program used source port 12345 in the past.

If this program keeps generating traffic, then we can use ' netstat -abn' or something similar.

How about if session already ends, how to find it?

Does anyone have idea? Any useful windows command or tools?

Regards,

Emr

Re: How to specify which program generates malicious traffic?

BPry — Thu, 03 Aug 2017 15:24:46 GMT

@emr_1,

Unless it's already been enabled windows doesn't really do a good job of recording anything like that on past sessions. You can same netstat information to a text file and write that information to a log file quetly in the background but that needs to be configured previously.

topic How to specify which program generates malicious traffic? in General Topics

How to specify which program generates malicious traffic?

Re: How to specify which program generates malicious traffic?