Overview
The TcpConnections command enumerates all active TCP connections on the system, including local and remote addresses, ports, connection states, and associated processes. This provides visibility into current network activity and can reveal C2 communications, lateral movement, or data exfiltration channels.Syntax
This command does not support remote execution.
Output
Returns TCP connection information:- Local address and port
- Remote address and port
- Connection state (Established, Listening, etc.)
- Process ID (PID)
- Process name
- Service name (if applicable)
Use Cases
- Red Team
- Blue Team
- Identify active network connections
- Discover listening services and ports
- Locate potential lateral movement targets
- Identify security product communications
- Map network topology
Example Output
Remote Execution
Detection Considerations
Low detection risk - reads TCP connection table from system.
- API Calls: Uses GetTcpTable2 or similar networking APIs
- No Network Traffic: Local enumeration only
- EDR Telemetry: May be logged as process behavior
Related Commands
- UdpConnections - Active UDP connections
- ARPTable - ARP cache entries
- DNSCache - DNS resolver cache
- NetworkShares - Network shares
- Processes - Running processes