Re: Identifying Malware in Outbound Traffic

[ted fred <exzactly () hotmail com>]

You can event correlate based on outbound traffic and a list of "known" bad 
ip addresses. This helps but they move so often its not a complete solution. 
You can also monitor your DNS server for weird query activity

If you want to buy something go with this:

Check out a product called FireEye http://www.fireeye.com/

-----Original Message----- 
From: hellkyng () gmail com
Sent: Thursday, September 15, 2011 12:08 PM
To: security-basics () securityfocus com
Subject: Identifying Malware in Outbound Traffic

This is an idea we've been playing around with a lot lately. I was hoping 
the experts here could give us some pointers to improve or modify our 
process.

We are looking at ways to find existing infections that have evaded 
anti-virus successfully within our network. We've started doing this by 
monitoring web traffic for anomalies that we think indicate an infection. 
For example searching for traffic to sites listed in the Malware Domain 
list. At a basic level this is finding some interesting results.

But I am curious are other people attempting similar things, if so how are 
they going about doing so? Any thoughts or recommendations would be 
appreciated.

Thanks,
Helly

------------------------------------------------------------------------
Securing Apache Web Server with thawte Digital Certificate
In this guide we examine the importance of Apache-SSL and who needs an SSL 
certificate.  We look at how SSL works, how it benefits your company and how 
your customers can tell if a site is secure. You will find out how to test, 
purchase, install and use a thawte Digital Certificate on your Apache web 
server. Throughout, best practices for set-up are highlighted to help you 
ensure efficient ongoing management of your encryption keys and digital 
certificates.

http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
------------------------------------------------------------------------


------------------------------------------------------------------------
Securing Apache Web Server with thawte Digital Certificate
In this guide we examine the importance of Apache-SSL and who needs an SSL certificate.  We look at how SSL works, how 
it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, 
install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are 
highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates.

http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
------------------------------------------------------------------------