0

I have been working on Wireshark lately. I am learning about malware behavior, but I am curious to know whether methods exist to detect malware download (via drive-by download) on systems.

Anti-virus program catch them, but however, is it possible that we can actually see one those malware that get downloaded (using Wireshark)? What notifications in Wireshark help us identify them?

Improve this question
2
  • It depends on the type of malware you want to find. It's only possible to see if the program connects to a server outside your PC. Then Wireshark can log this. You can identify it by looking at the logs of wireshark. There could be some strange connections outside your network and some downloads or uploads which you didn't want – CDRohling Feb 7 '19 at 13:50
  • Wireshark helps you see content. What you are asking is how to interpret content. What you are asking for is an IDS like snort. – schroeder♦ Feb 7 '19 at 13:51
1

The response is Yes, basically what you are referring is a NIDS (network intrusions detection system), bear in mind that Wireshark is not an NDIS, so in this case you will need to do the detection/analysis by your self.

Not all the cases for detect malware are covered by a NIDS and depends on the features of the system in place, but from the perspective of the network you can detect a very high percentage of malware. Obviously, depends a lot of the type of malware you want to detect, for example if a user downloads from a site a executable file with malware over a TLS connection a NDIS is not effectively, that's why is good to have an AV.

A good source of samples is lists.emergingthreats.net if you want to play with wireshark and pcap files with malware.

Improve this answer
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.