Advertisement
LaughingMan

Powershell: Gather Network Information

Dec 5th, 2019
315
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. function Get-TCPConnections {
  2.     $RawConnections = Get-NetTCPConnection
  3.     $Connections = $()
  4.  
  5.     foreach($rawConnection in $RawConnections)
  6.     {
  7.         if($rawConnection.RemoteAddress -eq "0.0.0.0" -or $rawConnection.RemoteAddress -eq "127.0.0.1" -or $rawConnection.RemoteAddress -eq "::")
  8.         {
  9.             continue;
  10.         }
  11.  
  12.         $Process = Get-Process -Id $rawConnection.OwningProcess
  13.         $Url = "http://ip-api.com/json/" + $rawConnection.RemoteAddress
  14.  
  15.         $Details = Invoke-RestMethod -Method Get -Uri $Url
  16.  
  17.         [PsCustomObject]@{
  18.             ProcessId = $Process.Id;
  19.             ProcessName = $Process.ProcessName;
  20.             HandleCount = $Process.Handles;
  21.             LocalAddress = $rawConnection.LocalAddress;
  22.             RemoteAddress = $rawConnection.RemoteAddress;
  23.             LocalPort = $rawConnection.LocalPort;
  24.             RemotePort= $rawConnection.RemotePort;
  25.             State = $rawConnection.State;
  26.             OffloadState = $rawConnection.OffloadState;
  27.             InstanceID = $rawConnection.InstanceID;
  28.             CreationTime = $rawConnection.CreationTime;
  29.             PSComputerName = $rawConnection.PSComputerName;
  30.             Name = $rawConnection.Name;
  31.             Caption = $rawConnection.Caption;
  32.             Description = $rawConnection.Description;
  33.             CountryCode = $Details.countryCode;
  34.             Country = $Details.country;
  35.             Region = $Details.region;
  36.             RegionName = $Details.regionName;
  37.             City = $Details.city;
  38.             Zip = $Details.zip;
  39.             Latitude = $Details.lat;
  40.             Longitude = $Details.lon;
  41.             Timezone = $Details.timezone;
  42.             ISP = $Details.isp;
  43.             Org = $Details.org;
  44.             As = $Details.as;
  45.             Query = $Details.query;
  46.         }
  47.     }
  48. }
  49.  
  50. $Connections = Get-TCPConnections
  51.  
  52. $Connections
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement