What is automated offender activity?¶

Automated offender activity is malicious or unauthorised action carried out by scripts, tools, bots or services with limited direct human interaction.

Evidential caution: that every event represents a separate human decision.

What this means¶

One instruction may trigger:

thousands of login attempts;

large-scale scanning;

account creation;

data collection;

spam;

malware deployment;

cryptomining;

denial of service;

repeated transactions.

what automation was used;

who or what configured or launched it;

which accounts or systems executed it;

the target selection;

the schedule or trigger;

what results were produced;

whether the automation adapted or received later tasking.

Repeated activity can show scale and method.

Likewise, automation may continue after the controller stops active involvement.

Automation may be event-driven rather than scheduled. A new account, received message, successful login or cloud event can trigger later actions. Preserve the trigger, workflow and downstream jobs so the sequence is not mistaken for simultaneous human activity.

Automated activity may still contain human-selected parameters, such as target lists, thresholds, schedules or exclusions. Those configuration choices may reveal objectives and control more clearly than the repeated output events. Preserve the input data and configuration used by the automation.

These inputs may materially support attribution, control and intent.

Separate the human decision, automated mechanism and repeated outputs, and attribute control from configuration, tasking and account evidence.

================================================================================

What to check or do next¶

• Investigators should establish:
• Preserve scripts, configuration, tasking, scheduler records, API keys, control infrastructure and result logs.
• Preserve them. The operational takeaway is:

Evidential limits¶

It may not.

It does not automatically show repeated intent by a human operator.