2

I am working on small project. There is an organization in which it has 100 around systems across the country. All of their machine's traffic goes through a single proxy monitored and maintained by the organization. Proxy is configured to use only white listed websites such as www.google.com and many others.(I am not aware about the proxy configuration that, are they using content based filtering or website URL based filtering? ).

If a machine sends traffic out of white listed domain, proxy alerts and then I need to manually analyze the machine.

Question:

How can I know due to which application/port/running process that traffic is occurring?

Is there any other way to stop this? Malware scanning tools identified nothing on the system.

If I recommend sysadmin to install disconnect, ghostery, blur, donottrackme and adblockplus like ad-dons will the number of reports generated by their proxy get reduced or not?

Any other permanent solution or global setting solution?

1

You will not be able to tell the application/port/process based on the network traffic alone. For that, you will need to analyze the logs on the endpoint.

The add-ons you mention to block ads will help in reducing the noise you are seeing, since I imagine you're seeing a ton of random ad-traffic tied to legitimate white-listed sites users are browsing to. The modern Internet is very loud with that stuff.

I recommend gathering logs from two places:

  • Border firewalls that block all HTTP/S except from your proxy server as the source -- that way if a machine is trying to connect to a C&C server through a process that is not proxy-aware (aka malware dropper / Trojan downloader) it will be denied and you will have visibility of it.
  • SysMon on each endpoint with process tracking and network tracking enabled. That way you can connect to the remote Event Log during an incident response to track which processes were communicating on which ports, etc., or even better use Syslog or a SIEM to aggregate these to a central location for review.

You will need to apply some analytical discretion when getting alerted on this stuff; known ad sites and redirectors will likely accompany typical browsing, SysMon will tell you which browser was being used but browser history logs may be cleared (or Incognito was used), and remember that some malware is proxy-aware.

  • Thank you for your valuable suggestions. I guess your first option is far better since blocking all malicious site is not a good idea and logic even. Need to block all sites except the whitelisted ones. – FrOgY Apr 15 '15 at 16:06
  • Also I have audited more than 20 system in which type of malware was different everytime. Sometimes trojon, sometimes backdoor or other infection. So cant really say that those are only responsible for this activity in which system pings to various sites than the whitelisted one. So something has to be done on network point only and for that your first options suites more. – FrOgY Apr 15 '15 at 16:09
  • Also keep in mind that more malware is using legit sites to hold its payload. Last week we ran into a VBA payload of a Word attachment in an email that obtained its malicious components from PasteBin.com, which you might whitelist. Same thing for Dropbox.com, Google Drive, etc. So you can't rely on the whitelist 100% of the time. – armani Apr 15 '15 at 16:15
  • By enabling heavy logging on each of the machines they'll want to monitor the disk space. If they have something that is filling a log quickly or something that's misconfigured it could run a system out of room if it doesn't have enough space on the OS partition or where ever the logs are being stored. – AbsoluteƵERØ Apr 15 '15 at 21:43
  • @AbsoluteƵERØ - All Windows Event logs -- SysMon included -- have maximum log size parameters, which are configurable. – armani Apr 15 '15 at 21:57
0

How can I know due to which application/port/running process that traffic is occurring?

Run netstat -ABN from the command line on the end point. This is real time snapshot though, so you'll have to run this while it's occurring.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.