> For the complete documentation index, see [llms.txt](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/zyberlab/07-security-investigation-basics/investigate-network-connection.md).

# Investigate an Unexpected Network Connection

## Objective

Use endpoint and network evidence to understand a simple outbound connection from `CLIENT01`.

## Lab System

* `CLIENT01`

## Generate Test Activity

Open a web browser on `CLIENT01` and visit a known safe website such as:

```
https://example.com
```

Close the browser tab after the page loads.

## Review Local Network Information

Open Command Prompt and run:

```
netstat -ano
```

Look for established or recently active TCP connections.

Record useful details such as:

* local address
* remote address
* remote port
* connection state
* PID

## Review Sysmon

If network connection logging is enabled in the Sysmon configuration, open the Sysmon Operational log and filter for:

```
3
```

Sysmon Event ID `3` records network connections when this event type is enabled.

Review fields such as:

* Image
* User
* SourceIp
* SourcePort
* DestinationIp
* DestinationPort
* DestinationHostname when available
* time created

## Correlate the Evidence

Compare the Sysmon event with the activity you generated.

Try to answer:

1. Which process created the connection?
2. Which user was running the process?
3. What destination was contacted?
4. Which destination port was used?
5. Does the timing match the browser activity?
6. Was the connection expected?

## Important Context

A remote IP address alone rarely proves that a connection is malicious.

Modern applications may contact multiple services, content-delivery networks, update systems, and cloud platforms. Investigation requires process, user, destination, timing, and business context.

## Example Finding

```
A browser process on CLIENT01 created an outbound HTTPS connection during the planned test.
The destination and timing matched the known browsing activity.
No unexpected process was associated with the connection.
```

## Security Relevance

Network investigation becomes more useful when network evidence is connected to endpoint context.

Knowing that an IP address was contacted is useful. Knowing which process, user, and system created the connection provides much stronger investigative context.