Problem Statement
When one looks at listening ports on ones machine and notices a port such as TCP 5985 listening but with an owning process ID of 4 (SYSTEM/kernel), outside of googling the port number, it appears difficult at best to try and track down the true program (binary) that's really behind the request for the listening port. In such an example with port 5985, I know it is WinRM, as I enabled that manually and saw the change. While I can google and assume that what may come back makes sense, that doesn't mean I truly know what's actually asking for it to listen on this port and I must assume that, next time, Google may not provide a definitive answer (I plan for the worst). To recreate this, one can go to PowerShell (elevated) and type Enable-PSRemoting. This will start the listener on 5985 by default and listen from owning PID 4.
Why I Care
In order to set up a workstation firewall policy at a large company, I'm running a large-scale project to look across thousands of machines for listening ports and aggregating results centrally in our log management tool (with heavy filtering/documentation for what I already know - so only looking for what's left). For each port, I interrogate the owning PID for who signed it, path/name, service name, file details (description, product name, etc.). However, with PID 4 that is, of course, not available, since it's the kernel itself. I really need to know more about the true program to make a more informed decision on initially blocking it during the testing phase or not. Either way, it must be understood and documented as to what it is and its reason for listening at all.
Question
How then does one trace back the port to the actual service that requested it? Of critical importance is to be able to trace this back programmatically via PowerShell (5.1 or 7.0 GA) or some other command-line tool in a script - it can't be GUI. I'm not a real developer, but I am pretty decent with PowerShell - until someone gives me a one-liner that makes me shake my head on how obvious this should have been to me.
Already Tried
Get-NetTCPConnection -State Listen -LocalPort 5985 | Select-Object *- Tcpvcon/TCPView
- ProcessExplorer (GUI anyway, wouldn't help me)
- ProcessHacker (GUI anyway, wouldn't help me)
For those that made it this far and especially to those who answer - THANK YOU!