Detect Caminho by looking for suspicious execution, persistence and command-and-control activity on affected hosts. Prioritise unusual process trees, unexpected binaries or scripts, and network connections that are out of pattern for the system. Use endpoint detection, firewall or proxy logs and any available threat intelligence to verify the finding before containment.
What Caminho activity looks like on a host
Detection starts with the host, not the label. Security teams should look for a cluster of behaviours that do not fit the system's normal baseline: odd parent-child process chains, binaries launched from user-writable locations, script engines spawning network tools, and new persistence mechanisms that reappear after reboot. Malware Guide is useful background because the same execution and evasion patterns that apply to common malware families also help explain why these artefacts matter.
Unexpected binaries and scripts are especially valuable when they appear together with command-line oddities, encoded arguments, or processes that are short-lived but repeatedly relaunch. The key judgement is whether the execution path is consistent with approved software or whether it suggests a staged payload, loader, or post-exploitation tooling operating under normal-looking process names.
Network and persistence signals that strengthen suspicion
Network telemetry is often what turns a weak lead into a credible detection. Look for outbound connections to rare destinations, unusual ports, periodic beaconing, DNS patterns that do not match the host role, or proxy requests that occur outside normal business workflows. When host execution and network behaviour line up, the signal is much stronger than either one alone.
Persistence is the other anchor point. Scheduled tasks, services, run keys, startup items, launch agents, or other auto-start mechanisms that are not expected on the affected asset should be treated as high-value evidence. The question is not only whether persistence exists, but whether it is attached to a process lineage, binary path, or script source that your environment would not normally tolerate.
For teams that want a threat-centric view of these patterns, MITRE ATT&CK Enterprise Matrix helps map suspicious process, persistence, and command-and-control behaviours to known adversary techniques, which is useful when you are deciding whether the activity is isolated or part of a broader intrusion chain.
How to validate before containment and what to collect
Validation should combine endpoint telemetry with independent network evidence. Use EDR to reconstruct the process tree, identify the first suspicious binary or script, and determine whether the behaviour originated from a legitimate parent process or from an injected, dropped, or renamed executable. Then corroborate that timeline with firewall, proxy, DNS, and any available threat intelligence so you can separate one-off noise from repeatable malicious activity.
Capture the artefacts that let you explain the event later: hashes, command lines, parent-child relationships, file paths, network indicators, service or task definitions, and the timestamps that tie them together. If the system is production-critical, preserve enough evidence first to support scoping and eradication decisions without losing the ability to confirm how the activity entered and persisted.
Risk and Threat Considerations
Suspicious execution plus persistence usually means the attacker has moved past initial access and is trying to keep a foothold. The main risk is that what looks like a small anomaly is actually the launch point for credential theft, lateral movement, or repeated command-and-control activity across additional hosts.
Failure mechanism: The compromise succeeds when malicious code blends into ordinary process activity, survives reboot through persistence, and uses normal-looking outbound traffic to avoid simple allowlists or manual review.
Impact: Delayed detection increases the chance of broader host compromise, additional payload delivery, and loss of confidence in whether the environment is still clean.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK provides the primary governance reference for this topic.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1059 — Command and Scripting Interpreter | Covers suspicious script and process execution seen in host-based detections. |
| T1547 — Boot or Logon Autostart Execution | Covers persistence mechanisms that keep malware active after reboot. | |
| T1071 — Application Layer Protocol | Covers command-and-control traffic that blends into normal network usage. | |
| Recommendation — Map suspicious script execution to T1059 and review the originating process chain. Hunt for autostart persistence and validate whether it matches approved software. Correlate outbound beaconing and proxy activity with other host evidence. | ||
Practitioner Guidance
What to prioritise: Start with the host that shows the clearest mix of suspicious execution and network anomalies, then work outward to adjacent systems that share the same binary, script, or destination pattern. A single strong host indicator is often enough to justify broader scoping if the same artefact appears elsewhere.
What to verify: Confirm whether the suspicious process chain is novel for that asset class, whether the binary is signed and expected, and whether the persistence mechanism matches sanctioned administration tools. If the evidence only shows one suspicious event with no persistence or network follow-through, treat it as lower confidence until corroborated.
Practitioner takeaway: The best detections combine lineage, persistence, and network context, because each one is easier for an intruder to fake than the full pattern together.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org