Investigate an open port with netstat and tasklist
On a canned, non-interactive Windows 11 practice host, use netstat -ano to identify the PID behind an unexpected listener, then use tasklist to map that PID to a process image. The output is a point-in-time socket snapshot. An unfamiliar port or process is a lead to investigate, not proof of malware or compromise. Closing the port or hardening the host is outside this lab. This page teaches a job procedure. These are not exam questions, this is not a score predictor, and nothing here is taken from any certification exam.
Steps
- 1
Run netstat -ano. Compare the listening rows with the expected Windows service baseline, then record 0.0.0.0:4444 and its owning PID 6132 as the entry that needs more investigation.
- 2
Run tasklist /fi "PID eq 6132". Record rtj-updater-svc.exe as the image associated with that PID in this canned snapshot, then carry the lead into a separate investigation and hardening workflow.
What you should see
The netstat snapshot shows expected Windows listeners on ports 135, 445, and 3389, plus the unexpected 0.0.0.0:4444 listener owned by PID 6132. The tasklist result maps PID 6132 to the synthetic rtj-updater-svc.exe image. This correlation does not establish whether the process is safe or malicious.