Local proxy detection
A technique for local proxy detection includes monitoring outbound traffic from the endpoint with remote network addresses outside the enterprise network, detecting use of a secure communication protocol with a request from the endpoint to one of the remote network addresses, identifying a plaintext network address within the request, and in response to identifying a plaintext network address in the request, initiating remediation of a potentially malicious local proxy on the endpoint.
1. A computer program product for detecting a malicious proxy on an endpoint in an enterprise network, the computer program product comprising a non-transitory computer readable medium having stored thereon computer executable code that, when executing on one or more computing devices, performs the steps of:
monitoring outbound traffic from the endpoint with remote network addresses outside the enterprise network;
detecting use of a secure communication protocol having a session key for securing communications in a request from the endpoint to one of the remote network addresses;
within the request using the secure communication protocol, identifying a plaintext network address including a plaintext alphanumeric address other than an Internet Protocol address for the one of the remote network addresses;
creating a malware identification based on a detection of the plaintext alphanumeric address within an encrypted portion of the request using the secure communication protocol; and
in response to the malware identification, initiating remediation of a potentially malicious local proxy on the endpoint.
2. The computer program product of claim 1 wherein the secure communication protocol is a hypertext transfer protocol using secure socket layer or transport layer security.
3. The computer program product of claim 1 wherein the plaintext network address includes a uniform resource locator.
4. The computer program product of claim 1 wherein monitoring the outbound traffic includes looking up a reputation for destinations of outbound communications included in the outbound traffic.
5. The computer program product of claim 1 wherein monitoring the outbound traffic includes monitoring outbound traffic at a gateway for the enterprise network.
6. The computer program product of claim 1 wherein initiating remediation of the potentially malicious local proxy includes quarantining the endpoint until the potentially malicious local proxy can be removed.
7. The computer program product of claim 1 wherein initiating remediation of the potentially malicious local proxy includes reversing a malware identification for the potentially malicious local proxy by identifying a non-malicious source of the local proxy.
8. The computer program product of claim 1 wherein initiating remediation of the potentially malicious local proxy includes verifying the malware identification by performing the steps of:
identifying a process that initiated the request;
determining a reputation of the process;
if the reputation of the process is low or unknown, confirming the malware identification; and
if the reputation of the process is good, confirming the malware identification only when an associated calling process has a low or unknown reputation.
9. A method comprising:
monitoring outbound traffic from an endpoint in an enterprise network;
detecting use of a secure communication protocol having a session key for securing communications in a request from the endpoint to a remote network address;
within the request using the secure communication protocol, identifying a plaintext network address including a plaintext alphanumeric address other than an Internet Protocol address for the remote network address;
creating a malware identification based on a detection of the plaintext alphanumeric address within an encrypted portion of the request using the secure communication protocol; and
in response to the malware identification, remediating a potentially malicious local proxy on the endpoint.
10. The method of claim 9 wherein the secure communication protocol is a hypertext transfer protocol using secure socket layer or transport layer security.
11. The method of claim 9 wherein the plaintext network address includes a uniform resource locator.
12. The method of claim 9 wherein monitoring the outbound traffic includes looking up a reputation for destinations of outbound communications included in the outbound traffic.
13. The method of claim 9 wherein monitoring the outbound traffic includes monitoring outbound traffic at a gateway for the enterprise network.
14. The method of claim 9 wherein initiating remediation of the potentially malicious local proxy includes quarantining the endpoint until the potentially malicious local proxy can be removed.
15. The method of claim 9 wherein initiating remediation of the potentially malicious local proxy includes reversing a malware identification for the potentially malicious local proxy by identifying a non-malicious source of the local proxy.
16. The method of claim 9 wherein initiating remediation of the potentially malicious local proxy includes verifying the malware identification by performing the steps of:
identifying a process that initiated the request;
determining a reputation of the process;
if the reputation of the process is low or unknown, confirming the malware identification; and
if the reputation of the process is good, confirming the malware identification only when an associated calling process has a low or unknown reputation.
17. A device comprising:
a network interface;
a memory; and
a processor, the processor configured by computer executable code stored in the memory to perform the steps of monitoring outbound traffic from an endpoint in an enterprise network, detecting use of a secure communication protocol having a session key for securing communications in a request from the endpoint to a remote network address, within the request using the secure communication protocol, identifying a plaintext network address including a plaintext alphanumeric address other than an Internet Protocol address for the remote network address, creating a malware identification based on a detection of the plaintext alphanumeric address within an encrypted portion of the request using the secure communication protocol and, in response to the malware identification, remediating a potentially malicious local proxy on the endpoint.
18. The device of claim 17 wherein the secure communication protocol is a hypertext transfer protocol using secure socket layer or transport layer security.