My aim is to tighten the firewall on my AD domain PC running Windows 10. Even though Windows firewall is already turned ON - I am not confident that it is blocking malware outbound traffic
What is an effective way to determine which outbound traffic are malware and which are initiated by legitimate apps (such as email and other business-related apps) ?
My initial thoughts are:
Since a legitimate app can make outbound calls to multiple IP (eg. MS telemetry services) - I will need to keep a track of all the legitimate IP (let's call it my IP whitelist)
Any outbound traffic to IP that is not on my whitelist - will be get blocked by my firewall rule
But this will be a costly task - as I will have to monitor and confirm each and every IP outbound connection :(
I know there must be a more effective way to achieve my aim - but not sure where to start