An Afghan police intelligence officer is being sought over the killing of two senior US Nato officers at the interior ministry in Kabul on Saturday.
Abdul Saboor, 25, was "the main suspect" and had fled the ministry following Saturday's attack, counter-terrorism officials told the BBC.
His family home in north-east Parwan province was raided overnight and his relatives in Kabul detained, they said.
Nato withdrew all its personnel from Afghan ministries after the shooting.
Mr Saboor had served in several Afghan ministries and had worked at the interior ministry for some time, officials said.
He was responsible for security arrangements and had access to secure radio communication channels used by the ministries.
"The fact that he is missing and we assume he fled, makes Abdul Saboor the main suspect for us in this case," said senior interior ministry officials.
"His family home was raided and searched last night, but he was not there. His relatives in Kabul have been detained."
One senior Afghan general told the BBC: ''The virus of infiltration has spread like a cancer and it needs an operation. Curing it has not helped."
The shootings came on the fifth day of deadly protests over the burning of copies of the Koran by US soldiers.
US personnel apparently inadvertently put the books into a rubbish incinerator at Bagram air base, near Kabul.
Muslims consider the Koran the literal word of God and treat each book with deep reverence.
Nato's commander in Afghanistan Gen John Allen said the attack had been carried out by "a coward whose actions will not go unanswered".
He said that for "obvious force protection reasons" all International Security Assistance Force (Isaf) personnel were being withdrawn from ministries in and around Kabul.
The BBC's Bilal Sarwary in Kabul says the withdrawal will paralyse important areas, such as technical support, intelligence sharing and many ongoing security operations.
It disconnects the co-ordination of the Afghan government with Isaf, says our correspondent, and could not have come at a worse time, with attacks taking place on police and army positions across several provinces.
US President Barack Obama has apologised for the Koran-burning incident, saying the material had been "inadvertently mishandled".