Investigating Suspicious Outbound Communications (C&C Communications) by Using Proxy Logs
Attackers usually configure their malware to communicate with their command and control servers, asking for new instructions to achieve their purpose. Most attackers adapt to the fact that most enterprises are implementing proxy devices for web browsing by configuring their malware to replicate the proxy server configuration of the victim’s system configuration. As a cyber defender, you should take advantage of the visibility provided by the web proxy through its logs of the C&C communications between the malware and its C&C server to investigate the attributes of such communications.
The objective of this chapter is to learn how to investigate C&C communications by using proxy logs with the questions, answers, and hypotheses technique. In this chapter, we will learn how to investigate most C&C communications attributes such as the web domain reputation and the suspicious...
