Investigating suspicious outbound communications (C&C communications)

In this chapter, our investigation of suspicious outbound communications through proxy logs follows a different investigative approach from the previous chapters. We will adopt the question-answer-hypothesis approach to effectively investigate these suspicious communications. Every investigation starts by raising a question, then providing all possible answers, which then leads to building a hypothesis. Acting upon this hypothesis involves either raising new questions or concluding the investigation process (see Figure 11.1):

Figure 11.1 – Investigation approach

To investigate such incidents, we will divide the rest of this chapter into the following subsections:

• Investigating the web domain reputation
• Investigating suspicious web target domain names
• Investigating the requested web resources
• Investigating the referrer URL
• Investigating the communications...