[chris_wot]

I am curious what network detection could be done to detect this sort of thing. Clearly the code needed to make outbound connections to hosts.

Some thoughts: if there is an encoded sub domain, flag this as suspicious.

Any code that uses a function to decode a base64 encoded string should be a red flag.

Any newly created thread code should be detected and checked most carefully.

Any others people can think of?

[WarOnPrivacy]

> what network detection could be done to detect this sort of thing. Clearly the code needed to make outbound connections to hosts.

Renting space that shares a netblock with a trusted host could make that more difficult.

[allyant]

Any decent static code analysers should be able to detect things like this (catch all’s statements, base64 encoding etc), I am surprised none seem to be used for production code.

[derwiki]

Is SCA often set up to run on the fully built end result running on the production machine? I’ve generally seen them as pre-merge-to-source-control.