How to find malicious communication leaving your network

The report explains how Zeus trojan variants use HTTP POSTs to contact C2 servers and commonly leave the Referer header empty; it provides example POST requests and recommends detecting these malicious patterns by observing absent referer fields and abnormal POST frequency, noting that the same heuristic can catch other HTTP-based malware.