-: In this short lab demonstration,
I'm going to show you two analytical tools.
One of which is going to be used to show us our open files
and the other one is going to be used
to show us our open sessions.
Now, by doing this we're going to be able
to go into the Windows command line
and use these two tools to see what files
are being accessed at any given time by our system.
This is very helpful when conducting an instant response
and trying to determine if malware is opening
or touching different files.
The second thing we're going to do
is look at the open network session,
which will show us if any of the connections
are being made from our machine out to the internet
or out to the rest of the network.
So, let's jump into the lab environment
and take a look at these commands.
So, the first command we're going to use
is known as open files.
To use this, we have to first enable
the file tracking on it.
And so we're going to do openfiles/local,
for the local machine, on.
This is going to tell it to turn this on.
Now that it's on, we have to reboot this machine,
so that it will enable it to track all of the open files.
I'm going to reboot the machine and be right back.
Okay, my computer has been rebooted,
and so now we can see what open files we have.
So, let's type in, openfiles, and then
this is going to be a lot of information,
so I'm actually going to do a pipe and then more,
which will give me one screen at a time.
Takes a couple of seconds for it to take an inventory
of the system, and then it's going to report this
out to the screen.
And so, here you can start seeing all of the files
that are currently open.
Notice we have the ID on the left,
we have the process name that's using it,
and then the open file.
So, if I'm looking at something and I'm worried
that it may be a piece of malware,
I can actually see what files that malware is touching,
the open files, and the process that's calling it.
And so, if I see something in the middle here
that's malware.exe for example, although most hackers
aren't going to call it that, then I can see
what it's touching on the right.
And so, this helps us as we go investigate
any kind of things that are happening
on this system.
And this is why it's one of our monitoring tools.
This can also be output to a file if you want,
or you can just display it to the screen
as I've done here.
And as you hit spacebar, you'll be able to see
all of the different files that are currently open,
by each of the different processes.
Now I'm going to go ahead an hit Control-C
to get back to my command prompt.
The next thing I want to show you
is how to look at open network sessions.
And to do this we're going to use the netstat command.
And so we do that by typing netstat -ano,
which is going to show me all of my network connections.
And again, this is going to be a lot of information,
so I'm going to use the more at the end as well.
So here we go.
On the left, you'll see the protocol in use,
TCP or UDP, you'll see the local address,
zero, zero, zero, zero is being used,
and you can see the ports that are open on this machine,
135 and 445, because this machine
has file sharing enabled.
So it's sitting there on those first two lines
and the state is listening.
They're listening for somebody who wants to share the files
with this computer.
Then you can see some of these other options here.
The high number 49,000 ports,
are because there are connections out to the outside world,
some kind of a website.
And then we have that callback that's being done,
so we open a high number port, set it to listening,
and then when we make that callout,
we went from our computer, some high number port,
out to that website address, over port 443.
So, this has a secure tunnel established.
And then you can see this as you go through
all of the different things that are going on.
Now, I would be interested to know
what are these particular IP addresses
that we are seeing.
This 52.173.28.179,
or 52.97.72.2.
If we start looking these up,
we can figure out if we have malware on our machine
or if these are legitimate processes.
For example, these might be the machine calling out
to Microsoft to say, is there a new update available?
Do you have a new antivirus definition?
Or things like that, because again,
I don't have any website currently open right now.
If I did, I would see that pop up in this display as well.
And again, if you hit spacebar,
you can go through all of your different screens
and see everything that is currently available
both in IPV4 and IPV6 as you see on the bottom.
That's the way this works when you use netstat -a-n-o.
It's going to show you all your current connections,
what's established, what's listening,
and what's making callouts.
I hope you found this demonstration useful,
as you learned a little bit about open files
and how you can monitor your local files and use,
and netstat to see what your network connections
are currently doing.