I often see advice in discussions about malware detection that emphasizes monitoring for suspicious network traffic. Honestly, this task seems easier said than done. For example, when using tools like Wireshark or GlassWire to capture network traffic, even during idle times, the amount of activity is overwhelming. There are hundreds of connections to various services and servers, making it nearly impossible to determine which are benign or malicious. What should I be looking for? Should I consult WHOIS information or check URLs on https://www.virustotal.com/ ?
None of these methods seem to provide clear assurance of whether something is amiss. This is particularly challenging when malicious activity is discreet, not blatantly uploading my entire hard drive all at once, and is cleverly disguised, like hiding within svchost.exe. Could you suggest what indicators, tools, or approaches I might use to better understand and evaluate the network activities on my PC?
your_credit_card_detailsbeing send to a website that you have just submitted them to is obviously not suspicious, whereasyour_credit_card_detailsbeing sent to a random unregistered server probably is.