What rules should I make to find short lived connections?

[securityconscious]

What rules should I make to find short lived connections like ones made by malware?

[EdwinKM]

a firewall rule is permanent. Is this for prevention or are you investigating something?
Malware sessions are from inside to outside (internet). You can block known destinations.

[securityconscious]

a firewall rule is permanent. Is this for prevention or are you investigating something?
Malware sessions are from inside to outside (internet). You can block known destinations.

Both prevention and investigation. I suspect they are from inside and I don't know what IP they are connecting to. I'm new to firewalls and OPN Sense.

[EdwinKM]

you can off course block all (internet -  !rfc1918) destinations and check the firewall blocks. But this creating bulk of logging. So unusable. You have any valid reason the suspect any malice?