Kansa
Kansa copied to clipboard
davehull
Create Get-NetstatObject.ps1
Per conversation ref: https://github.com/davehull/Kansa/issues/207 Submitted pull request
Do you know if there's a specific version of PS or the Get-NetTCPConnection cmdlet that returns the OwningProcess property? In my local lab running PS 5.1 and that property does not exist. Also given that Get-NetTCPConnection only returns TCP connections, it's probably worth renaming this collector from Get-NetstatObject.ps1 to something like Get-NetstatTCP.ps1.
I tested on two verisons the oldest being 5.1.17134.858 Could you try the following? Get-WMIObject -namespace Root\StandardCIMV2 -Class MSFT_NetTCPConnection Piping that to gm or ogv to see if the wmi object has owningprocess ? Could rewrite it with WMI if that works instead of Get-NetTCPConnection
I agree with the renaming.
Compatible after v3.0+ for PowerShell, utilizing the Get-CimInstance is a newer, better implementation. It is faster than the Get-WmiObject commands, and comply better with CIM and WSMAN standards, allowing better cross-platform compatability and more flexibility. Get-CimInstance (and all -Cim cmdlets) are able to leverage the WSMAN protocol, whereas WMI cmdlets can only use DCOM RPC. By making one tweak, it can increase speed, increase compatibility, and is implemented in native PowerShell since v3.0.
Get-CimInstance -Namespace root/StandardCimv2 -ClassName MSFT_NetTCPConnection
Should be the newer, more PS way to accomplish the same task.
@mwilco03 thoughts?
100% agree with this assessment @davehull can you validate from your local lab?
@davehull @covertpanda
Per the discussion, I have refactored the code to achieve two goals, first be more readable, secondarily I have pulled the UDP information as well.
IDK how applicable it would be to an enterprise wide sweep / IR investigation but doing the code this way could also allow for functionalization of the code (ie grabbing all procs wither or not they are talking)
-Edited got it working :-) -Edited updated pull request
Going through old requests & wondering if you've had a chance to test this.