What is command and control over web traffic?¶
The practical answer¶
Command and control over web traffic uses ordinary-looking HTTP or HTTPS requests to carry tasking or results.
The key evidential caution¶
The dangerous assumption is that web traffic is harmless because it uses common ports and encryption.
It may not be.
Malicious traffic can be blended with ordinary browsing and application activity.
Evidence to preserve¶
Investigators should preserve:
Key points¶
- the responsible process
- destination domain and address
- URL or request path
- method
- headers
- user-agent
- request and response size
- timing
- certificate information
- proxy records
- resulting system activity
Encrypted traffic may prevent content inspection.
That does not remove all evidential value.
Metadata, process linkage, unusual destinations, repeated timing and later actions may still support the assessment.
Evidential limits¶
Do not assume that every unusual web request is command and control.
Software updates, telemetry, APIs and browser extensions can create similar patterns.
Where a web server is compromised, legitimate website traffic and control traffic may share the same infrastructure.
Where proxy or gateway records are available, preserve full request metadata before retention expires. URL paths, headers and response sizes may be more informative than the destination domain alone. Current product settings may affect what content was logged or decrypted.
Also identify whether the traffic came from a browser, background service, script or injected process. The same URL may have a very different meaning depending on the process that generated it.
Correlate the request with local process and account activity before attributing it to malware or an operator.
Operational takeaway¶
Assess web-based command and control through process, destination, request pattern and resulting behaviour, not merely the use of HTTP or HTTPS.