A computer-implemented method for detection and prevention of an attempt at establishment of a network connection for malicious communication, comprising: detecting, by a client terminal, a connection establishment process for establishing a network connection, the connection establishment process initiated by code running on the client terminal, collecting, by the client terminal, call stack data, collecting, by an endpoint module installed on the client terminal, thread-related flow data, wherein collecting the thread-related flow data comprises: identifying a creation of a new thread based on monitoring the operating system for creation of new thread; analyzing the parent thread of the new thread to determine whether the parent thread is associated with malicious activity; and marking the current thread as malicious when the parent thread is determined to be malicious; transmitting, by the client terminal, flow data including the call stack data and the thread-related flow data to a network gateway residing at a remote server, receiving, by the network gateway, the flow data transmitted by the client terminal, Z analyzing, by the network gateway, the flow data to detect an attempt at establishing a connection for malicious activity and/or communication, wherein analyzing the flow data comprises: detecting a presence or absence of a trial to establish a malicious communication, the trial identified by detecting an attempt at establishing the network connection for the malicious communication when the flow data represents illegal flow data, and generating a signal representing the presence or absence of malicious communication; wherein when the signal represents the presence of malicious communication, generating, by the network gateway, a network message, transmitting said network message to the client terminal, blocking and/or preventing, by the client terminal, the connection establishment process, and when the signal represents the absence of a malicious communication, generating a message, transmitting said message to the client terminal, continuing, by the client terminal, the connection establishment process. detecting, by a client terminal, a connection establishment process for establishing a network connection, the connection establishment process initiated by code running on the client terminal, collecting, by the client terminal, call stack data, collecting, by an endpoint module installed on the client terminal, thread-related flow data, wherein collecting the thread-related flow data comprises: identifying a creation of a new thread based on monitoring the operating system for creation of new thread; analyzing the parent thread of the new thread to determine whether the parent thread is associated with malicious activity; and marking the current thread as malicious when the parent thread is determined to be malicious; identifying a creation of a new thread based on monitoring the operating system for creation of new thread; analyzing the parent thread of the new thread to determine whether the parent thread is associated with malicious activity; and marking the current thread as malicious when the parent thread is determined to be malicious; transmitting, by the client terminal, flow data including the call stack data and the thread-related flow data to a network gateway residing at a remote server, receiving, by the network gateway, the flow data transmitted by the client terminal, Z analyzing, by the network gateway, the flow data to detect an attempt at establishing a connection for malicious activity and/or communication, wherein analyzing the flow data comprises: detecting a presence or absence of a trial to establish a malicious communication, the trial identified by detecting an attempt at establishing the network connection for the malicious communication when the flow data represents illegal flow data, and generating a signal representing the presence or absence of malicious communication; wherein when the signal represents the presence of malicious communication, generating, by the network gateway, a network message, transmitting said network message to the client terminal, blocking and/or preventing, by the client terminal, the connection establishment process, and when the signal represents the absence of a malicious communication, generating a message, transmitting said message to the client terminal, continuing, by the client terminal, the connection establishment process.