How to Use Windows PowerShell ‘Get-NetTCPConnection’ to Hunt Rogue Connections

The Invisible Network Threat

If you suspect a Windows workstation is infected with spyware, simply opening the Task Manager is useless. Modern malware doesn’t consume 100% of your CPU or drastically slow down the machine; its entire goal is to remain invisible.

However, malware cannot hide its ultimate objective: it must establish a network connection to a remote Command and Control (C2) server to exfiltrate stolen data.

To hunt for these stealthy, rogue connections, systems administrators historically used the legacy netstat command. In modern Windows 11 environments, the definitive tool for advanced socket auditing is the PowerShell cmdlet: Get-NetTCPConnection.

1. Auditing All Active Connections

Open an elevated PowerShell prompt (Run as Administrator) and execute:

Get-NetTCPConnection

Unlike the chaotic text output of the old netstat tool, this PowerShell cmdlet returns highly structured, object-oriented data. You will see precise columns for Local Address, Local Port, Remote Address, Remote Port, and the exact TCP State (e.g., Established, Listen, TimeWait).

2. Filtering for Suspicious Activity

Staring at hundreds of local sockets is overwhelming. The true power of PowerShell is the ability to filter the objects in real-time.

If you want to hunt for active, established connections communicating with external, internet-based IP addresses (ignoring safe local connections like 127.0.0.1), you can pipeline the command:

Get-NetTCPConnection | Where-Object { $_.State -eq 'Established' -and $_.RemoteAddress -notmatch '^127\.' -and $_.RemoteAddress -notmatch '^192\.168\.' -and $_.RemoteAddress -notmatch '^10\.' }

This command strips away the noise and leaves you with a definitive list of exactly which external IP addresses the computer is currently transmitting data to.

3. Linking the Connection to the Exact Process

If you find a suspicious connection to a strange IP address, you must identify exactly which application on the computer is generating the traffic.

The Get-NetTCPConnection object contains a property called OwningProcess, which is simply the Process ID (PID) of the application. By piping this data directly into the Get-Process cmdlet, you can instantly unmask the rogue application.

Get-NetTCPConnection -State Established | Select-Object LocalPort, RemoteAddress, RemotePort, @{Name="ProcessName";Expression={(Get-Process -Id $_.OwningProcess).ProcessName}}

This advanced one-liner builds a customized, actionable report. It dynamically maps every single active external connection to the exact executable file (e.g., chrome.exe, spotify.exe, or an unknown malicious binary like svchost32.exe) driving the traffic.

Conclusion

The Get-NetTCPConnection cmdlet is a foundational tool for Incident Response and threat hunting. By leveraging object-oriented filtering and dynamic process mapping, it allows IT administrators to instantly peel back the abstraction layer of Windows and expose exactly what the computer is transmitting to the outside world.