Maltrail is a network traffic detection system that identifies communication with known malicious infrastructure and reports selected traffic anomalies.
Maltrail solves the problem of detecting when hosts on a network communicate with known malicious domains, URLs, IP addresses, and other indicators of compromise. It works by matching observed network traffic against a set of indicators called trails, which combine more than 3,000 bundled static files with 42 public-feed integrations and optional operator-supplied trails. Beyond indicator matching, the tool applies heuristics to detect scanning activity, DNS exhaustion, domain generation algorithm-like lookups, suspicious downloads, proxy probes, and anomalous User-Agent values. A detection records the source, destination, protocol, matched trail, classification, and trail source as a single event.
Maltrail suits organizations that want indicator-based network monitoring with visibility into malicious communications. It is designed as a complement to endpoint telemetry and intrusion prevention systems rather than a replacement for them. The tool's architecture separates the sensor, which captures traffic and performs detection, from the server, which handles reporting and event intake; these can run on the same host or separately. The reporting interface provides live updates, field-aware search, geographic views, and retro hunting capabilities. Plain-text trails and whitelists can be reviewed and version-controlled, and the system supports multiple output formats including local logging, remote Maltrail logging, CEF over syslog, and Logstash JSON output.
The sensor is implemented in Rust using libpcap with optional Linux packet fanout workers for parallel capture, while the server and reporting interface run in Python. The project includes deployment validation tooling and optional Prometheus metrics. Docker and systemd deployment options are provided, and the README documents installation from source as well as through an installer.
