How to specify which program generates malicious traffic?

[emr_1]

Hello all,

I know this question is outside of the PAN device matter. 

But my customer asked me how to specify the program on his computer for removing malicious program.

Let me tell you exmaple:

When I see threat log, it shows

Src 192.168.1.1:12345 

Dst 100.100.100.100:80

We can understand that we need to investigate 192.168.1.1 device.

On this device, we don't know how to specify which program used source port 12345 in the past.

If this program keeps generating traffic, then we can use ' netstat -abn' or something similar.

How about if session already ends, how to find it?

Does anyone have idea? Any useful windows command or tools?

Regards,

Emr

[BPry · Accepted solution]

@emr_1,

Unless it's already been enabled windows doesn't really do a good job of recording anything like that on past sessions. You can same netstat information to a text file and write that information to a log file quetly in the background but that needs to be configured previously.