Enhanced Botnet Detection

by Dave Breslin
July 2, 2012

EnhancedBotnetDetection

This dashboard was designed to be used with the Enhanced Botnet Detection in Nessus including the plugin update to divide inbound and outbound connection results. It also reports results found by the malware checks found in the Nessus Backdoors plugin family.

A large portion of the Nessus plugins whose results will be reported in the template require Nessus credentialed scanning.

There are many more additional malware detection plugins beyond those whose results are reported by the template, for example:

59275 Malicious Process Detection
52670 Web Site Links to Malicious Content
58182 DNSChanger Malware Detection
33950 MS Executable Detection
35322 HTTP Backdoor Detection
31854 Malware Payload Code detection
29871 Web Server Malicious Javascript Link Detection
16314 Microsoft Windows SMB : Suspicious Software Detection
11329 Virus Infection Detection

The following are excellent sources of information on Nessus malware detection:

Detecting Known Malware Processes Using Nessus
Nessus and the Fight against Viruses
Detecting Microsoft Executables Being Served by an Unknown Service with Nessus
#7 Nessus Versus Malware - Top Ten Things You Didn't Know About Nessus