What is a command-and-control server?¶
The practical answer¶
A command-and-control server is infrastructure used to receive communications from compromised systems and send instructions, configuration or payloads.
The key evidential caution¶
The dangerous assumption is that the owner or subscriber of the server is necessarily the offender.
It may not be.
The server may be:
Key points¶
- rented cloud infrastructure
- a compromised website
- a hijacked server
- a shared hosting account
- a proxy or relay
- a temporary virtual machine
- a legitimate platform abused for control
Evidence to preserve¶
Investigators should preserve:
Key points¶
- the domain and IP information
- hosting provider
- account identifiers
- server configuration
- access logs
- payment and registration records
- uploaded files
- linked certificates
- control-panel activity
- relevant timestamps
A device contacting the server may support a link to the infrastructure.
It does not automatically prove that the server issued commands or that the subscriber personally operated it.
Evidential limits¶
Likewise, a server may support several malware campaigns or unrelated users.
Where lawful and proportionate, provider-held records may help identify the account, payment route or access source used to manage the server.
Do not rely only on current ownership. Infrastructure can be reassigned, rebuilt or transferred.
The historical state at the time of the incident matters.
The server may also be one layer in a larger chain. Reverse proxies, redirectors and relay hosts can separate the public address from the system where commands are created. Preserve provider and access records for each identified layer and avoid collapsing them into one server identity.
Operational takeaway¶
Treat command-and-control infrastructure as a technical and provider-attribution layer, and require separate evidence before identifying the person who operated it.