1. A method of detecting malicious software, comprising: monitoring a plurality of Domain Name System (DNS) requests from host server computers in a multi-tenant environment; using a monitoring server computer in the multi-tenant environment, identifying a first common pattern of behavior of the DNS requests across multiple of the host server computers, the first common pattern of behavior that is independent of domain lookup including correlating at least two of the multiple host server computers to determine if they are making a plurality of same DNS requests at periodic intervals, which is indicative of malicious software being present on the host server computers and attempting to contact a command-and-control server; for DNS requests that have the identified first common pattern of behavior that is independent of domain lookup, detecting at least a second pattern of behavior associated with the DNS requests, wherein the detecting the second pattern of behavior includes analyzing each domain name for statistical probability of randomness including an analysis of how numbers are placed within the domain names; and generating a confidence level output associated, at least in part, with the detection of the at least second pattern of behavior as a weighted parameter, which is indicative of DNS requests being generated from malicious software.