4 ms·
Is there an easy way to check if your computer is compromised and is part of a botnet?
by mrhappyunhappy 8y ago
Is there an easy way to check if your computer is compromised and is part of a botnet?
- tgragnato 8y agoIt depends: you need to rely on an IoC to notice a piece of malware. This is typically a signature, a direct communication with a known C2 or a malicious URLs, a hash, ... Beyond the most simple techniques, I'd mention traffic monitoring and analysis (especially traffic flow analysis) and behavioural analysis. However detecting a dormant botnet isn't easy nor simple. e.g.: DARPA (via HACCS) awarded a $1.2m contract to build a system that can automatically pinpoint botnet-infected devices. https://www.fbo.gov/?s=opportunity&mode=form&id=72de4936f6f4d88cc838a624c1157f26&tab=core&_cview=0 https://www.fbo.gov/?s=opportunity&mode=form&id=72de4936f6f4...
- tenaciousDaniel 8y agoThis alert has some info about where the malware is installed. That would be a good place to start: https://www.us-cert.gov/ncas/alerts/TA18-331A https://www.us-cert.gov/ncas/alerts/TA18-331A