NETSTAT.EXE

Top Paths

• C:\Windows\System32100%
• C:\Windows\SysWOW64<0.01%

Top Hashes (SHA256)

• 99aea381404590d29d014adafee68be27089456b283ece224f8c6f3a90b200a852.57%
• 2faced0aba2a30b41dc2112f70a9b0c076c58ec2d25dfc5c7646c32b763c095412.47%
• b094e827af70241d71bed9767ec1a254fdc4164a646b2ba4c7105cd783adba0d12.34%
• 868d7bf6975d7acf69a7069dc46d0614ac6e995929c64425f44cc080e71d7afe10.25%
• ed8036ec92b551adf0096e8950b30c99a8050e93b63dfd3234ae2a1ff1c2a2084.79%
• 9f070e1f4aa9ae0a5ea084febbd5983293e5748d0a5cc5d46098cb9271d2d5082.93%
• 4631c03a1cc798eef61ccda3ec887475e201c9a7d14a90a1deee86be622139512.14%
• 5c748735f5d876a84163d16b042f3ac92d27131b352012e42e16fae89d1a890d1.64%
• fca53341aefc183c6c6725cdc411378a73e325590d4e5fe04102743b63593c920.33%
• 9372044b501fefae7333a59624379dbfc7e4eccbea965ee7058f2583709c22870.2%

Top Grandparents

• LTSVC.exe99.97%
• services.exe0.03%
• explorer.exe<0.01%
• dsAccessService.exe<0.01%
• cmd.exe<0.01%
• svchost.exe<0.01%
• WmiPrvSE.exe<0.01%
• userinit.exe<0.01%
• MsSense.exe<0.01%
• conhost.exe<0.01%

Top Parents

• cmd.exe99.21%
• QualysAgent.exe0.77%
• WssPowerShell.exe0.01%
• AMPWatchDog.exe<0.01%
• AvastSvc.exe<0.01%
• powershell.exe<0.01%
• wsmprovhost.exe<0.01%
• conhost.exe<0.01%
• webexmta.exe<0.01%
• find.exe<0.01%

Top Children

• conhost.exe94.83%
• cmd.exe4.67%
• find.exe0.27%
• NETSTAT.EXE0.11%
• powershell.exe0.04%
• ShoretelRegistry.exe0.04%
• tasklist.exe0.04%

What does NETSTAT.EXE normally do?

Located in C:\Windows\System32. Almost exclusively launched by cmd.exe (99.2% in this dataset). Also launched by monitoring agents (QualysAgent). Very high execution count reflects its use in scripted health checks and monitoring. Common flags include -an (all connections, numeric), -ano (with PID), -b (with owning process).

When is NETSTAT.EXE suspicious?

netstat.exe in isolation is not suspicious, but it is one of the most common reconnaissance tools used by attackers during the discovery phase. When seen alongside other reconnaissance commands (whoami, ipconfig, net user, tasklist, systeminfo) within a short time window from the same parent process, it indicates enumeration activity. Spawned by unusual parents like w3wp.exe or wmiprvse.exe (suggesting remote execution).

How do attackers abuse NETSTAT.EXE?

Network reconnaissance: attackers run netstat -ano to identify active connections, listening services, and established sessions on a compromised host. This helps them understand the network topology, identify lateral movement targets, and find services they can exploit. Almost always part of a broader enumeration sequence rather than used alone.

Detection guidance

Do not alert on netstat.exe alone — it is too common and too noisy. Instead, build correlation rules: multiple reconnaissance tools (netstat, whoami, ipconfig, net user, tasklist) executed within a short time window from the same parent or user session. netstat spawned by wmiprvse.exe or w3wp.exe is higher-confidence. Stack with other signals rather than using as a standalone detection.

False positive notes

Extremely common in monitoring scripts, health checks, and management agent routines. The vast majority of netstat executions in most environments are from automated scripts via cmd.exe. QualysAgent and similar vulnerability scanners run netstat regularly.

MITRE ATT&CK techniques