What is command and control?¶
The practical answer¶
Command and control is the communication used to direct, manage or receive information from compromised devices, accounts or malicious software.
The key evidential caution¶
The dangerous assumption is that any connection to suspicious infrastructure proves command and control.
It may not.
A device may contact an external address because of:
Key points¶
- ordinary web browsing
- software updates
- cloud services
- security scanning
- advertising
- background applications
- malware
- remote administration
Command-and-control activity may involve:
- periodic beaconing
- tasking commands
- configuration updates
- file transfer
- interactive control
- status reporting
- collection of system information
- delivery of further payloads
What investigators should establish¶
Investigators should establish:
Key points¶
- which process or account made the connection
- which destination was contacted
- how often contact occurred
- what protocol or service was used
- whether data was exchanged
- what activity followed
- whether the destination was shared or dedicated
A network connection alone may show communication.
It does not automatically prove that commands were received or executed.
Evidential limits¶
Likewise, suspicious infrastructure may host many unrelated users or services.
Relevant evidence¶
Relevant evidence may exist in endpoint telemetry, DNS logs, proxy logs, firewall records, network captures, malware configuration and provider data.
Command-and-control channels may be direct, relayed or hidden inside legitimate services. A compromised device may contact one server that forwards tasking elsewhere, while the operator uses a separate management console. Preserve the full path where possible rather than treating the first visible destination as the whole control system.
Record whether the channel remained available after containment, because continuing contact may show another active foothold.
Operational takeaway¶
Treat command and control as a relationship between the compromised system and a controlling channel, and prove the communication, tasking and resulting activity separately.