[PowerShell]监听端口记录哪个程序执行
while(1){
netstat -ano | ForEach-Object {
if((($_ -split "\s+")[3] | ?{$_ -match "(:+80)$"}) -And (($_ -split "\s+")[4] | ?{$_ -match "SYN_SENT"})){
echo $_ | Out-File -Append c:\task.log
if(($_ -split "\s+")[4] | ?{$_ -match "SYN_SENT"}){
$P=($_ -split "\s+")[5]
#echo $P
tasklist /FI "PID eq $P"
tasklist /FI "PID eq $P" | Out-File -Append c:\task.log
}
}
}
}