What evidence may show command tasking?¶
The practical answer¶
Command tasking is shown by evidence that instructions were delivered to a compromised system and acted upon or acknowledged.
The key evidential caution¶
The dangerous assumption is that an outbound connection proves tasking.
It does not.
Relevant evidence¶
Useful evidence may include:
Key points¶
- decoded commands
- downloaded task files
- API responses
- malware configuration changes
- remote-shell history
- process creation
- file operations
- network requests immediately following a response
- result uploads
- operator-console logs
What investigators should establish¶
Investigators should establish:
Key points¶
- what instruction was received
- when it arrived
- which process handled it
- whether it executed
- what result followed
- whether the result was returned
Where traffic is encrypted, tasking may be inferred from repeated response-and-action patterns.
That inference should be stated cautiously.
A server response may contain routine configuration rather than a command.
A command may be received but fail.
A task may be queued and executed later.
Correlate network, endpoint and provider evidence.
The stronger the link between the response and a specific resulting action, the stronger the tasking conclusion.
Tasking may be encoded, compressed or encrypted. Specialist analysis may be needed to interpret the content, but local execution evidence remains important. A decoded command demonstrates intended instruction; process and system records show whether that instruction was actually carried out.
Where a task fails, preserve the error and any revised command. Repeated adaptation may support operator involvement and can show what capability the controller was attempting to achieve.
This may materially strengthen the reconstruction.
Operational takeaway¶
Prove command tasking through the relationship between received instructions, local execution and returned results, not from communication alone.