Detecting malicious command and control cloud traffic

A non-transitory, computer-readable storage medium having stored thereon instructions to detect malicious communication between a command and control (C2) cloud resource on a cloud application and malware on an infected host that, upon execution by one or more processors, cause the one or more processors to:

• intermediate cloud traffic between a plurality of clients and a plurality of cloud applications over a secure tunnel established between the plurality of clients and a network security system, wherein the secure tunnel reroutes the cloud traffic to the network security system;
• receive one or more incoming requests from a client in the plurality of clients, wherein the incoming requests are directed to a cloud application in the plurality of cloud applications, and wherein the cloud application has a plurality of resources;
• based on analyzing the one or more incoming requests, determine that the incoming requests are targeted at one or more malicious resources in the plurality of resources;
• and
• based on the determination:
• prevent transmission of the incoming requests to the malicious resources,
• make the malicious resources unavailable for receiving future incoming requests, and
• keep other resources in the plurality of resources available for receiving the future incoming requests.

A network security system, comprising:

• one or more processors;
• and
• a memory having stored thereon instructions to detect malicious communication between a command and control (C2) cloud resource on a cloud application and malware on an infected host that, upon execution by the one or more processors, cause the one or more processors to:
• intermediate cloud traffic between a plurality of clients and a plurality of cloud applications over a secure tunnel established between the plurality of clients and the network security system, wherein the secure tunnel reroutes the cloud traffic to the network security system;
• receive one or more incoming requests from a client in the plurality of clients, wherein the incoming requests are directed to a cloud application in the plurality of cloud applications, and wherein the cloud application has a plurality of resources;
• based on analyzing the one or more incoming requests, determine that the incoming requests are targeted at one or more malicious resources in the plurality of resources;
• and
• based on the determination:
• prevent transmission of the incoming requests to the malicious resources,
• make the malicious resources unavailable for receiving future incoming requests, and
• keep other resources in the plurality of resources available for receiving the future incoming requests.