What is remote command execution?¶
Remote command execution is the ability to cause a system to run commands from another device or service.
Avoid the dangerous assumption¶
The dangerous assumption is that every remotely initiated command proves an interactive human session.
It may not.
Commands may be sent through:
- remote desktop
- remote shell
- RMM software
- web shells
- exploited applications
- cloud administration tools
- automation platforms
- malware
- management APIs.
Investigators should establish:
- which account or service authorised the command
- what mechanism delivered it
- which system executed it
- the exact command
- the time
- the result
- what files, processes or changes followed.
Relevant evidence may include command history, process creation, API logs, management-platform records, web-server logs, authentication records and network connections.
Do not assume the command text alone proves successful execution. It may have failed, lacked permission or been blocked.
Likewise, the same command may be legitimate or malicious depending on context, authority and target.
A script or automation may issue many commands from one configured task.
The source address may identify an intermediary system rather than the person responsible.
Where remote command execution is suspected, preserve the process chain and the control-channel evidence before remediation.
Remote command execution may also occur through a compromised orchestration or deployment platform, causing the command to appear as authorised system activity. Preserve the upstream job, operator and approval records where available.
The resulting system activity should be attributed to the remote mechanism first.
Operational takeaway¶
Prove how the command reached the system, what executed and what result followed, and distinguish automated tasking from interactive control.