Create Get-NetstatObject.ps1

[mwilco03]

No description provided.

[mwilco03]

Per conversation ref: #207
Submitted pull request

[davehull]

Do you know if there's a specific version of PS or the Get-NetTCPConnection cmdlet that returns the OwningProcess property? In my local lab running PS 5.1 and that property does not exist. Also given that Get-NetTCPConnection only returns TCP connections, it's probably worth renaming this collector from Get-NetstatObject.ps1 to something like Get-NetstatTCP.ps1.

[mwilco03]

I tested on two verisons the oldest being 5.1.17134.858
Could you try the following?
Get-WMIObject -namespace Root\StandardCIMV2 -Class MSFT_NetTCPConnection
Piping that to gm or ogv to see if the wmi object has owningprocess ?
Could rewrite it with WMI if that works instead of Get-NetTCPConnection

I agree with the renaming.

[covertpanda]

Compatible after v3.0+ for PowerShell, utilizing the Get-CimInstance is a newer, better implementation. It is faster than the Get-WmiObject commands, and comply better with CIM and WSMAN standards, allowing better cross-platform compatability and more flexibility. Get-CimInstance (and all -Cim cmdlets) are able to leverage the WSMAN protocol, whereas WMI cmdlets can only use DCOM RPC. By making one tweak, it can increase speed, increase compatibility, and is implemented in native PowerShell since v3.0.

Get-CimInstance -Namespace root/StandardCimv2 -ClassName MSFT_NetTCPConnection

Should be the newer, more PS way to accomplish the same task.

@mwilco03 thoughts?

[mwilco03]

100% agree with this assessment @davehull can you validate from your local lab?

[davehull]

I should have some time to check this out tomorrow. Thanks.

[mwilco03]

@davehull @covertpanda
Per the discussion, I have refactored the code to achieve two goals, first be more readable, secondarily I have pulled the UDP information as well.

IDK how applicable it would be to an enterprise wide sweep / IR investigation but doing the code this way could also allow for functionalization of the code (ie grabbing all procs wither or not they are talking)

-Edited got it working :-)
-Edited updated pull request

[davehull]

Have you updated the PR? I've got some time today to check it out.

[mwilco03]

No sorry, I’ll get it updated today.

[mwilco03]

Finally got back to this updated PR

[mwilco03]

Going through old requests & wondering if you've had a chance to test this.