Investigating suspicious outbound communications (C&C communications)
In this chapter, our investigation of suspicious outbound communications through proxy logs follows a different investigative approach from the previous chapters. We will adopt the question-answer-hypothesis approach to effectively investigate these suspicious communications. Every investigation starts by raising a question, then providing all possible answers, which then leads to building a hypothesis. Acting upon this hypothesis involves either raising new questions or concluding the investigation process (see Figure 11.1):
Figure 11.1 – Investigation approach
To investigate such incidents, we will divide the rest of this chapter into the following subsections:
- Investigating the web domain reputation
- Investigating suspicious web target domain names
- Investigating the requested web resources
- Investigating the referrer URL
- Investigating the communications...
