Given that a lot of websites now use TLS/https to encrypt all network traffic: If a client machine is compromised and does need to establish a back channel to a C&C-Server for additional instructions and data exfiltration, can it be successfully hidden in HTTPS traffic?
Network based intrusion detection systems have - unless utilizing a HTTPS proxy - little knowledge of what other resources are to be loaded after an initial page load. If the malware sends a heartbeat by using suspicious header data on an HTTPS request (and gets tasking back in form of maybe an image treated with steganography, can regular network based IDS pick that up if the DNS requests do not trigger anything and the IPs are not on a blacklist?
Additionally, as port 443 is usually allowed in firewalls (and established connections are usually allowed back), this seems to be a good spot to hide in plain sight.
How could this be determined to be malicious content when it's properly encrypted? Could this allow malware to hide it's communication from the sight of most analysis?
What are possible ways to pick up and detect malware that hides its communications in this way, i.e. sending a single request whenever it must and there is a lot of https traffic to different servers ongoing anyways, for example with an initial facebook loading?