Investigating Suspicious Outbound Communications (C&C Communications) by Using Proxy Logs

Attackers usually configure their malware to communicate with their command and control servers, asking for new instructions to achieve their purpose. Most attackers adapt to the fact that most enterprises are implementing proxy devices for web browsing by configuring their malware to replicate the proxy server configuration of the victim’s system configuration. As a cyber defender, you should take advantage of the visibility provided by the web proxy through its logs of the C&C communications between the malware and its C&C server to investigate the attributes of such communications.

The objective of this chapter is to learn how to investigate C&C communications by using proxy logs with the questions, answers, and hypotheses technique. In this chapter, we will learn how to investigate most C&C communications attributes such as the web domain reputation and the suspicious...

Suspicious outbound communications alerts

After successfully gaining initial access to the victim’s machine and installing malware through one of the various ways, such as employing weaponized Microsoft Office documents or malware spread via removable media, the malware authors usually configure their malware to communicate with their command and control server to get new instructions and commands to be executed on the victim machine. Such malicious communications have a list of aspects that can be detected and investigated over the proxy logs as we will see later in this chapter.

During the SOC analyst’s working shift, they may get an alert from their security information and event management (SIEM) solution regarding communications from one of the organization’s machines to a suspicious/malicious domain or IP that seems to be related to a command and control server. Such alerts may be triggered according to different detection criteria, such as threat intel...

Investigating suspicious outbound communications (C&C communications)

In this chapter, our investigation of suspicious outbound communications through proxy logs follows a different investigative approach from the previous chapters. We will adopt the question-answer-hypothesis approach to effectively investigate these suspicious communications. Every investigation starts by raising a question, then providing all possible answers, which then leads to building a hypothesis. Acting upon this hypothesis involves either raising new questions or concluding the investigation process (see Figure 11.1):

Figure 11.1 – Investigation approach

To investigate such incidents, we will divide the rest of this chapter into the following subsections:

• Investigating the web domain reputation
• Investigating suspicious web target domain names
• Investigating the requested web resources
• Investigating the referrer URL
• Investigating the communications...

Summary

During this chapter, we discussed how to investigate C&C communications by using the proxy logs with the questions, answers, and hypotheses method to investigate some C&C communications attributes, such as the web domain reputation and suspicious target domain names, the requested web resources, the referrer URL, the communications user agent, the communications destination port, the received and sent bytes, the HTTP method, and the Content-Type. Finally, we discussed some command and control techniques.

In the next chapter, we will discuss how to investigate external threats.