Analysts want to hunt newly registered C2 domains used against city workstations. Where should they look first?

Hunting newly registered C2 domains used against city workstations starts where name resolution happens: DNS logs from the city's recursive resolvers. Those logs show which clients queried which domains and when, enabling pivots on rare or newly observed names tied to workstation populations before or without knowing the eventual IP. Firewall sessions may later show destinations, but DNS is the first place domain-based C2 hypotheses become searchable across the civic estate.

Badge-reader door events at the pump-station gate provide physical access context, not domain queries, and cannot list newly registered C2 names. The library fine-payment kiosk receipt printer produces print jobs and fiscal receipts, not recursive DNS telemetry for workstations. HVAC temperature setpoints in the courthouse building automation system are environmental measurements unrelated to C2 domain resolution on staff PCs.

Exam caveat: domain and C2 hunts begin with DNS (and related proxy or URL logs when browsing is in play); physical access and OT distractors do not answer name-resolution questions.

Operational check: extract rare domains from recursive DNS for workstation networks over the hunt window, enrich with registration age and threat intelligence, join to client sources via CIM Network_Resolution or DNS fields, and escalate matching hosts into EDR process review.