What is a bot?¶
A bot is a device, account or software process operating automatically under programmed or remote direction.
Avoid the dangerous assumption¶
The dangerous assumption is that automated activity means no person is responsible.
Automation changes how actions are performed, not whether someone configured, controlled or benefited from them.
A malicious bot may:
- send spam
- scan systems
- attempt logins
- conduct denial-of-service activity
- download commands
- steal information
- spread malware
- commit advertising or account fraud.
A compromised device may become part of a botnet without the owner’s knowledge.
Investigators should identify:
- what process or account performed the activity
- whether it acted automatically
- where commands or configuration came from
- how often it communicated
- what tasks it completed
- who controlled the infrastructure.
Evidence may include scheduled execution, regular network traffic, command-and-control records, configuration files, tasking commands and large volumes of repetitive events.
Do not assume that the subscriber or device owner intentionally participated. The device may have been compromised.
Likewise, do not assume that one bot event represents one human decision. Thousands of actions may follow one command or configuration.
A bot may also perform legitimate functions, such as monitoring, indexing or service automation. Context and authorisation matter.
Where several compromised devices perform the same task, compare command timing and configuration. Similarity may show common tasking without proving that each device was controlled directly or by the same person.
One controller may also task many devices simultaneously.
Operational takeaway¶
Determine what was automated, how it was tasked and who controlled the process, while separating the compromised device owner from the bot operator.