1. A method comprising: at a server having connectivity to the Internet, retrieving sets of proxy logs from a plurality of proxy servers, wherein each proxy server of the plurality of proxy servers is associated with a network and generates network traffic logs for one or more nodes included in the network; determining a set of executables hosted by each of the one or more nodes associated with each of the plurality of proxy servers; analyzing each set of executables to detect a specific executable; identifying portions of each of the network traffic logs that are likely to be associated with the specific executable; and generating an alert indicating the portions of each of the network traffic logs as likely to be associated with the specific executable.