I have been working on Wireshark lately. I am learning about malware behavior, but I am curious to know whether methods exist to detect malware download (via drive-by download) on systems.
Anti-virus program catch them, but however, is it possible that we can actually see one those malware that get downloaded (using Wireshark)? What notifications in Wireshark help us identify them?
The response is Yes, basically what you are referring is a NIDS (network intrusions detection system), bear in mind that Wireshark is not an NDIS, so in this case you will need to do the detection/analysis by your self.
Not all the cases for detect malware are covered by a NIDS and depends on the features of the system in place, but from the perspective of the network you can detect a very high percentage of malware. Obviously, depends a lot of the type of malware you want to detect, for example if a user downloads from a site a executable file with malware over a TLS connection a NDIS is not effectively, that's why is good to have an AV.
A good source of samples is lists.emergingthreats.net if you want to play with wireshark and pcap files with malware.
