I have been working on Wireshark lately. I am learning about malware behavior, but I am curious to know whether methods exist to detect malware download (via drive-by download) on systems.
Anti-virus program catch them, but however, is it possible that we can actually see one those malware that get downloaded (using Wireshark)? What notifications in Wireshark help us identify them?