The Afghan soldier who killed U.S. Major General Harold Greene had spent three years in the army before he squeezed off two to three bursts of gunfire from a first-floor window at a senior military delegation in Kabul, officials said on Wednesday.
As details emerged about Tuesday's attack at a military complex in the Afghan capital, a picture was forming of a rogue Afghan soldier who may have been difficult to spot before he killed Greene and wounded 14 coalition troops.
Greene was the most senior U.S. military official killed in action overseas since the war in Vietnam. His father described him to Reuters as a popular kid growing up whose intellect led to his military success.
"He was unique to the military," the father said. "He was performing a function that took in everything from research to development and he helped develop weapons systems that really help save a lot of lives in the field."
A U.S. military official in Washington offered details about the positioning of the gunman firing on the group from inside a building and the limited number of bursts of gunfire.
A spokesman for the German forces' mission command in Potsdam, near Berlin, said the shooting at the complex on the outskirts of Kabul came from a neighbouring building. Brigadier General Michael Bartscher of Germany was among the wounded.
"(The) delegation was listening to a speech in the open air on the premises of the Marshal Fahim National Defense University when somebody opened fire," the spokesman said.
High-ranking officers such as generals normally travel with their own small security details.
In the immediate aftermath of the attack, the Afghan Defence Ministry had described the gunman, who was also killed, as a "terrorist in army uniform", indicating its belief he was an Islamist militant who had infiltrated the army from outside.
Details about the identity of the soldier and his motivation remained vague, but the fact that he had spent so long in the army before turning on fellow soldiers was likely to be a major line of inquiry in an investigation launched on Wednesday.
"What motivated the shooting is still under investigation, but the shooter was an army soldier, not a terrorist from outside the base," an Afghan defence official said.
Initial findings from the investigation were due to be given to Afghan President Hamid Karzai by late Wednesday.
The attack raised questions about the ability of NATO soldiers in Afghanistan to train local forces.
Most foreign soldiers plan to withdraw from the country by the end of 2014, but, recognising the challenge Afghan forces face in battling a vicious insurgency led by the Taliban, a contingent could remain beyond the deadline in a training and counter-terrorism role.
The U.S. official said Tuesday's apparent inside attack was still seen as a somewhat "isolated case" and not the start of a new campaign. "Right now we're looking at this as an outlier," the official said.
At their peak in 2012, so-called "insider" attacks threatened the foundation of the U.S.-led mission in Afghanistan and prompted the coalition to bring in a host of measures to reduce interaction with their local allies.
The number of incidents fell from nearly 50 in 2012 to about 15 last year. Before Tuesday's attack, there had only been two in 2014, according to U.S. figures.
"Despite all security measures, such attacks by insiders can never be totally ruled out," a German defence ministry spokesman said.
The coalition, called the International Security Assistance Force (ISAF), insisted the attack would not compromise its plans to train and assist Afghanistan's fledgling armed forces, built from scratch after the Taliban were ousted in 2001.
"We do not view the incident at Marshal Fahim National Defense University in Kabul yesterday as representative of the positive relationship which we have nurtured," it said in a statement.
According to an Afghan Interior Ministry official, initial information suggests that the attacker was called Rafiullah.
The defence official said he was a low-ranking soldier who was recruited to join the army from Paktika province in eastern Afghanistan bordering Pakistan.
The area is a hotbed of Taliban activity and a stronghold of their Islamist militant allies, the Haqqani network.