Let's check out some of the usual suspect scenarios which can
be described through the real‑life cases.
Mass scans is a fairly common phenomenon where individuals and
organizations give themselves a right to scan the whole IP range,
that is the whole internet on a daily basis.
Then comes anonymous attackers.
To spot the potential attackers hidden behind the Tor Anonymity Network,
Maltrail utilizes publicly available lists of Tor exit nodes.
Then comes malware in case of connection attempts coming from infected
computers inside the organization towards already known C&C servers.
Suspicious HTTP requests. In case of suspicious requests coming from
outer web application, security scanners, and the internal user malicious
attempts towards unknown websites and other threats could be found. Port
scanning. In case of too many connection attempts towards a considerable
amount of different TCP ports, Maltrail will warn about the potential
port scanning. As a result of it, heuristic mechanism detection.