With the increasing amount of malware HTTPS traffic, it is a challenge to discover new features and methods to detect malware without decrypting the traffic. Our research goal is to detect malware HTTPS connections using data from the Bro IDS logs, that does not need to decrypt the traffic. Bro offers information about flows, SSL handshakes and X.509 certificates. These three types of data give us enough information to create powerful features and machine learning algorithms to detect the malicious HTTPS traffic with good accuracy. Our machine learning algorithm uses 40 different features. A core part of our research was the production and selection of correct datasets. We used 13 datasets from the CTU-13 malware dataset, 55 malware datasets from the Stratosphere Malware Capture Facility Project (done by Maria Jose Erquiaga) and we produced 20 of our own normal datasets. Our results show that malware HTTPS behaviour is distinct from normal HTTPS behaviour and that our methods are able to detect malware with good accuracy without decrypting the traffic.