Processes which have open network sockets

osquery.txt

-- C:\WINDOWS\system32>echo select p.name, p.pid, s.local_address, s.local_port, s.remote_address, s.remote_port from process_open_sockets s join processes p on p.pid = s.pid; | osqueryi
osquery> select p.name, p.pid, s.local_address, s.local_port, s.remote_address, s.remote_port from process_open_sockets s join processes p on p.pid = s.pid;

-- https://osquery.io/docs/tables/#process_open_sockets
-- https://osquery.io/docs/tables/#processes

+------------------------------+-------+---------------------------+------------+---------------------------+-------------+
| name                         | pid   | local_address             | local_port | remote_address            | remote_port |
+------------------------------+-------+---------------------------+------------+---------------------------+-------------+
| System                       | 4     | 0.0.0.0                   | 80         | 0.0.0.0                   | 0           |
| svchost.exe                  | 952   | 0.0.0.0                   | 135        | 0.0.0.0                   | 0           |
| System                       | 4     | 0.0.0.0                   | 445        | 0.0.0.0                   | 0           |
.
..
...
....
.....
......