0

My aim is to tighten the firewall on my AD domain PC running Windows 10. Even though Windows firewall is already turned ON - I am not confident that it is blocking malware outbound traffic

What is an effective way to determine which outbound traffic are malware and which are initiated by legitimate apps (such as email and other business-related apps) ?

My initial thoughts are:

  1. Since a legitimate app can make outbound calls to multiple IP (eg. MS telemetry services) - I will need to keep a track of all the legitimate IP (let's call it my IP whitelist)

  2. Any outbound traffic to IP that is not on my whitelist - will be get blocked by my firewall rule

But this will be a costly task - as I will have to monitor and confirm each and every IP outbound connection :(

I know there must be a more effective way to achieve my aim - but not sure where to start

1

Malware uses many ways to communicate, including misusing twitter feeds, comments in forums or hacked sites with a higher reputation. Malware can also do their communication by hijacking browsers. Thus, it is impossible to simply block all malware communication simply by restricting access to specific IP addresses or by only allowing connections initiated by the browser or mail client.

AV products or perimeter firewalls might help to block a major part of malware traffic (but not all) by using curated blacklists and/or deeper analysis of the traffic. And, depending on the role your system has in the network you might explicitly limit its connection to the specific hosts it should communicate with and deny everything else (i.e. use a white list of a few known good and trusted hosts/networks and not a black list).

  • What traffic pattern would indicate a likelihood of malware being the culprit ? Where could I find more information on traffic analysis to identify malware ? – Tickle Me Aug 8 '17 at 15:06
  • @TickleMe: Anything which does not look like normal traffic could be malware :) Also, anything which looks like normal traffic could be smarter malware. As for more details just search for malware traffic detection and you'll find zillions of papers of various qualities which then have lots of references to other information. There is no single constant source of such information because attackers and defenders continuously evolve their techniques. – Steffen Ullrich Aug 8 '17 at 16:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.